15

I do not understand the ouput of the lsof command.

When i write 

lsof -p PID

I get 4 lines and when I write 

lsof | grep PID

I get hundreds of lines.

Shouldn't it return the same result?

Thank you for your responses. Here are output. Looks like it is sub process or what this tasks mean?

lsof -p 29076
COMMAND   PID  USER   FD      TYPE DEVICE SIZE/OFF NODE NAME
java    29076  pr    cwd   unknown                      /proc/29076/cwd (readlink: Permission denied)
java    29076  pr    rtd   unknown                      /proc/29076/root (readlink: Permission denied)
java    29076  pr    txt   unknown                      /proc/29076/exe (readlink: Permission denied)
java    29076  pr   NOFD                                /proc/29076/fd (opendir: Permission denied)

lsof |grep 29076|head -20
java      29076        pr  cwd   unknown                          /proc/29076/cwd (readlink: Permission denied)
java      29076        pr  rtd   unknown                          /proc/29076/root (readlink: Permission denied)
java      29076        pr  txt   unknown                          /proc/29076/exe (readlink: Permission denied)
java      29076        pr NOFD                                    /proc/29076/fd (opendir: Permission denied)
java      29076   300  pr  cwd   unknown                          /proc/29076/task/300/cwd (readlink: Permission denied)
java      29076   300  pr  rtd   unknown                          /proc/29076/task/300/root (readlink: Permission denied)
java      29076   300  pr  txt   unknown                          /proc/29076/task/300/exe (readlink: Permission denied)
java      29076   300  pr NOFD                                    /proc/29076/task/300/fd (opendir: Permission denied)
java      29076   329  pr  cwd   unknown                          /proc/29076/task/329/cwd (readlink: Permission denied)
java      29076   329  pr  rtd   unknown                          /proc/29076/task/329/root (readlink: Permission denied)
java      29076   329  pr  txt   unknown                          /proc/29076/task/329/exe (readlink: Permission denied)
java      29076   329  pr NOFD                                    /proc/29076/task/329/fd (opendir: Permission denied)
java      29076   330  pr  cwd   unknown                          /proc/29076/task/330/cwd (readlink: Permission denied)
java      29076   330  pr  rtd   unknown                          /proc/29076/task/330/root (readlink: Permission denied)
java      29076   330  pr  txt   unknown                          /proc/29076/task/330/exe (readlink: Permission denied)
java      29076   330  pr NOFD                                    /proc/29076/task/330/fd (opendir: Permission denied)
java      29076   331  pr  cwd   unknown                          /proc/29076/task/331/cwd (readlink: Permission denied)
java      29076   331  pr  rtd   unknown                          /proc/29076/task/331/root (readlink: Permission denied)
java      29076   331  pr  txt   unknown                          /proc/29076/task/331/exe (readlink: Permission denied)
java      29076   331  pr NOFD                                    /proc/29076/task/331/fd (opendir: Permission denied)
IL Mare
  • 151
  • 1
  • 1
  • 4

5 Answers5

7

Without seeing the actual output it's hard to say exactly what is happening but I'm guessing it's caused by the fact that the lsof -p PID command is just printing out files that are opened by the specified PID while the lsof | grep PID is printing out any lines where 'PID' is located anywhere in the line. For example, if you're searching for PID=123 then your grep option will also print lines for PID's 1231, 1232, 1233, etc. as well as any files which are located in folders with 123 anywhere in their full path.

EDIT: In your specific example the difference is that lsof is ignoring files opened by a thread. If you look at the output in the grep example the third column is the 'TID' or Thread ID. Lines without a TID match what you were seeing when you used the -p option. Lines with a TID (ie. lines opened by other threads) are the extras.

David King
  • 3,147
  • 8
  • 23
2

lsof - list open files , try to read the man page for lsof #man lsof

lsof -p PID lists open files associated with process id of PID.

In the absence of any options, lsof lists all open files belonging to all active processes. when you do lsof | grep PID , it lists all open files belonging to all active processes and grep the PID number , which can match to PID itself and also anywhere, where PID appears as part of other PIDs and may be the child process of PID as well, and so on.

Therefore, if you want to use lsof | grep PID then you should match the PID exactly , like full word match lsof | grep -w PID , but it will still result in more lines if PID have other child processes.

Ijaz Ahmad
  • 7,146
  • 5
  • 32
  • 45
1

Some versions of lsof include a thread id. This can be determined by the TID column header apparent in the output. Such an output will give rise to a duplication of entries since lsof will potentially show duplicated entries one for each thread.

https://support.datastax.com/hc/en-us/articles/209826153-lsof-shows-Cassandra-is-holding-a-large-amount-of-files-open

Vladimir Ondrus
  • 11
  • 1
0

I tried this on my system, and both commands generate the same lists, I suggest you try both commands consecutively several times, just to make sure that the state of process is stable. According to the man page and your outputs, this is the only explanation I can have.

user148564
  • 39
  • 2
-1

Above output is seen if the process behind the PID is not owned by the user running lsof. You probably need to be root in order to get the desired output.

Rayn0r42
  • 1