lsof Identify Resource Locked Process

Samba server comes with a handy utility called smbstatus to report users who are holding the shared resources.

Utilities used to find out processes that are locking system resources are among the most wanted system utilities for experienced users and system administrators. The lsof being one of such excellent utility that used to identify process or user that is locking system resource such as file or network socket.

For example, a system administrator could use the lsof -i to easily understand how the IBM MQ server communicate over the TCP/IP network with IBM Informix server. The lsof output, as in the diagram below, shows that the Informix oninit is listening to a user defined mnemonic port name stp which the IBM MQ server communicate with. The /etc/services system files is usually used to map a numeric port number to a descriptive port name defined by user.

1. Execute lsof -i TCP to report all processes that are accessing the TCP sockets found on the system
   
   
2. Execute lsof -i tcp:8080 to find out what process is holding TCP port 8080.
   
   
3. Execute lsof without any command options to list system wide resources that are using by processes running in the system.
   
   
4. Execute lsof -p 456 to show all resources that are being held by process id 456
   
   
5. Some programs might running on the Linux system by more than one instance. In this case, type lsof -c ProgramName instead of lsof -p PID to get a broader scope of view. For example, lsof -c squid to find out what are the resources held by all squid processes running on the system.
   
   
6. Execute lsof -u keith to confirm resources that are being held by user id keith
   
   
7. Execute lsof /home/keith/secretfile to find out what are the processes that are locking the specify file /home/keith/secretfile

Related information:

• Another utility called fuser has similar features as of lsof utility. Executing fuser -m /media/cdrom will report all process id that are holding the specify resource.
  
  Each of the process id suffix with an ASCII character code which represent the resource access type. These resource access type codes are not standardize among various Linux distributions. To be safe and accurate, always consult the fuser man page to confirm the code definitions.
  
  To check out what process ID is using TCP port 8080, execute the fuser as fuser -n tcp 8080 or fuser 8080/tcp
  
  
• The native network related Linux command netstat is a good tool to find out what program or command is binding to a TCP and UDP port. For example, there are Bind, Djbdns, etc, used to bind with port 53 for DNS protocol. By executing netstat command as
  
  netstat -tulap
  
  will shows both the program and process id that bind to the network port. The diagram below shows the commands output of lsof vs netstat.
  
  
  
  Both of the commands displaying pseudo port name instead of numeric port number, where the mapping of pseudo port name and numeric port number is defined in /etc/services file.
  
  The netstat command, however, able to display numeric port and IP address with -n option switch. For example, rewrite the command as netstat -tulapn
  
  Note! Both netstat -tulap and lsof -i MUST be executed with root user account privileges, else nothing as those in the diagram above will be seen.
  
  
• Search more related info with Google Search engine built-in