diff options
Diffstat (limited to 'misc-utils/lsfd.1.adoc')
| -rw-r--r-- | misc-utils/lsfd.1.adoc | 667 |
1 files changed, 667 insertions, 0 deletions
diff --git a/misc-utils/lsfd.1.adoc b/misc-utils/lsfd.1.adoc new file mode 100644 index 0000000..23eee28 --- /dev/null +++ b/misc-utils/lsfd.1.adoc @@ -0,0 +1,667 @@ +//po4a: entry man manual +//// +Copyright 2021 Red Hat, Inc. + +This file may be copied under the terms of the GNU Public License. +//// += lsfd(1) +:doctype: manpage +:man manual: User Commands +:man source: util-linux {release-version} +:page-layout: base +:command: lsfd +:colon: : + +== NAME + +lsfd - list file descriptors + +== SYNOPSIS + +*lsfd* [option] + +== DESCRIPTION + +*lsfd* is intended to be a modern replacement for *lsof*(8) on Linux systems. +Unlike *lsof*, *lsfd* is specialized to Linux kernel; it supports Linux +specific features like namespaces with simpler code. *lsfd* is not a +drop-in replacement for *lsof*; they are different in the command line +interface and output formats. + +The default output is subject to change. So whenever possible, you should avoid using +default outputs in your scripts. Always explicitly define expected columns by using +*--output* _columns-list_ in environments where a stable output is required. + +*lsfd* uses Libsmartcols for output formatting and filtering. See the description of *--output* +option for customizing the output format, and *--filter* option for filtering. Use *lsfd --help* +to get a list of all available columns. + +== OPTIONS + +*-l*, *--threads*:: +List in threads level. + +*-J*, *--json*:: +Use JSON output format. + +*-n*, *--noheadings*:: +Don't print headings. + +*-o*, *--output* _list_:: +Specify which output columns to print. See the *OUTPUT COLUMNS* +section for details of available columns. ++ +The default list of columns may be extended if _list_ is specified in +the format +_list_ (e.g., *lsfd -o +DELETED*). + +*-r*, *--raw*:: +Use raw output format. + +*--notruncate*:: +Don't truncate text in columns. + +*-p*, *--pid* _pids_:: +Collect information only for specified processes. +_pids_ is a list of pids. A comma or whitespaces can be used as separators. +You can use this option with *pidof*(1). See *FILTER EXAMPLES*. ++ +Both *-Q* option with an expression including PID, e.g. -Q (PID == 1), +and *-p* option, e.g. -p 1, may print the same output but using *-p* +option is much more efficient because *-p* option works at a much earlier +stage of processing than the *-Q* option. + +*-i*[4|6], *--inet*[=4|=6]:: +List only IPv4 sockets and/or IPv6 sockets. + +*-Q*, *--filter* _expr_:: +Print only the files matching the condition represented by the _expr_. +See also *FILTER EXAMPLES*. + +*-C*, *--counter* __label__:__filter_expr__:: +Define a custom counter used in *--summary* output. *lsfd* makes a +counter named _label_. During collect information, *lsfd* counts files +matching _filter_expr_, and stores the counted number to the +counter named _label_. *lsfd* applies filters defined with *--filter* +options before counting; files excluded by the filters are not counted. ++ +See *FILTER EXPRESSION* about _filter_expr_. +_label_ should not include `{` nor `:`. You can define multiple +counters by specifying this option multiple times. ++ +See also *COUNTER EXAMPLES*. + +*--summary*[=_when_]:: +This option controls summary lines output. The optional argument _when_ +can be *only*, *append* or *never*. If the _when_ argument is omitted, +it defaults to *only*. ++ +The summary reports counters. A counter consists of a label and an +integer value. *--counter* is the option for defining a counter. If +a user defines no counter, *lsfd* uses the definitions of pre-defined +built-in counters (default counters) to make the summary output. ++ +CAUTION{colon} Using *--summary* and *--json* may make the output broken. Only combining *--summary*=*only* and *--json* is valid. +//TRANSLATORS: Keep {colon} untranslated. + +*--debug-filter*:: +Dump the internal data structure for the filter and exit. This is useful +only for *lsfd* developers. + +*--dump-counters*:: +Dump the definition of counters used in *--summary* output. + +include::man-common/help-version.adoc[] + +== OUTPUT COLUMNS + +Each column has a type. Types are surround by < and >. + +//TRANSLATORS: Keep {colon} untranslated. +CAUTION{colon} The names and types of columns are not stable yet. +They may be changed in the future releases. + +AINODECLASS <``string``>:: +Class of anonymous inode. + +ASSOC <``string``>:: +Association between file and process. + +BLKDRV <``string``>:: +Block device driver name resolved by `/proc/devices`. + +CHRDRV <``string``>:: +Character device driver name resolved by `/proc/devices`. + +COMMAND <``string``>:: +Command of the process opening the file. + +DELETED <``boolean``>:: +Reachability from the file system. + +DEV <``string``>:: +ID of the device containing the file. + +DEVTYPE <``string``>:: +Device type (`blk`, `char`, or `nodev`). + +ENDPOINT <``string``>:: +IPC endpoints information communicated with the fd. +The format of the column depends on the object associated +with the fd: ++ +FIFO type::: +_PID_,_COMMAND_,_ASSOC_[-r][-w] ++ +The last characters ([-r][-w]) represents the read and/or +write mode of the endpoint. + ++ +*lsfd* collects endpoints within the processes that +*lsfd* scans; *lsfd* may miss some endpoints +if you limits the processes with *-p* option. + +FD <``number``>:: +File descriptor for the file. + +FLAGS <``string``>:: +Flags specified when opening the file. + +FUID <``number``>:: +User ID number of the file's owner. + +INET.LADDR <``string``>:: +Local IP address. + +INET.RADDR <``string``>:: +Remote IP address. + +INET6.LADDR <``string``>:: +Local IP6 address. + +INET6.RADDR <``string``>:: +Remote IP6 address. + +INODE <``number``>:: +Inode number. + +KNAME <``string``>:: +// +// It seems that the manpage backend of asciidoctor has limitations +// about emitting text with nested face specifications like: +// +// `_u_` p +// +// Not only u but also p is decorated with underline. +// +Raw file name extracted from +from ``/proc/``_pid_``/fd/``_fd_ or ``/proc/``_pid_``/map_files/``_region_. + +KTHREAD <``boolean``>:: +Whether the process is a kernel thread or not. + +MAJ:MIN <``string``>:: +Device ID for special, or ID of device containing file. + +MAPLEN <``number``>:: +Length of file mapping (in page). + +MISCDEV <``string``>:: +Misc character device name resolved by `/proc/misc`. + +MNTID <``number``>:: +Mount ID. + +MODE <``string``>:: +Access mode (rwx). + +NAME <``string``>:: +Cooked version of KNAME. It is mostly same as KNAME. ++ +Some files have special formats and information sources: ++ +NETLINK::: +protocol=_NETLINK.PROTOCOL_[ lport=_NETLINK.LPORT_[ group=_NETLINK.GROUPS_]] ++ +PACKET::: +type=_SOCK.TYPE_[ protocol=_PACKET.PROTOCOL_][ iface=_PACKET.IFACE_] ++ +pidfd::: +pid=_TARGET-PID_ comm=_TARGET-COMMAND_ nspid=_TARGET-NSPIDS_ ++ +*lsfd* extracts _TARGET-PID_ and _TARGET-NSPIDS_ from +``/proc/``_pid_``/fdinfo/``_fd_. ++ +PING::: +state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]] ++ +PINGv6::: +state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]] ++ +RAW::: +state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]] ++ +RAWv6::: +state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]] ++ +TCP::: +TCPv6::: +state=_SOCK.STATE_[ laddr=_TCP.LADDR_ [ raddr=_TCP.RADDR_]] ++ +UDP::: +UDPv6::: +state=_SOCK.STATE_[ laddr=_UDP.LADDR_ [ raddr=_UDP.RADDR_]] ++ +*lsfd* hides ``raddr=`` if _UDP.RADDR_ is ``0.0.0.0`` and _UDP.RPORT_ is 0. ++ +UDP-LITE::: +UDPLITEv6::: +state=_SOCK.STATE_[ laddr=_UDPLITE.LADDR_ [ raddr=_UDPLITE.RADDR_]] ++ +UNIX-STREAM::: +state=_SOCK.STATE_[ path=_UNIX.PATH_] ++ +UNIX::: +state=_SOCK.STATE_[ path=_UNIX.PATH_] type=_SOCK.TYPE_ + +NETLINK.GROUPS <``number``>>:: +Netlink multicast groups. + +NETLINK.LPORT <``number``>>:: +Netlink local port id. + +NETLINK.PROTOCOL <``string``>>:: +Netlink protocol. + +NLINK <``number``>:: +Link count. + +NS.NAME <``string``>:: +Name (_NS.TYPE_:[_INODE_]) of the namespace specified with the file. + +NS.TYPE <``string``>:: +Type of the namespace specified with the file. +The type is `mnt`, `cgroup`, `uts`, `ipc`, `user`, `pid`, `net`, +`time`, or `unknown`. + +OWNER <``string``>:: +Owner of the file. + +PACKET.IFACE <``string``>:: +Interface name associated with the packet socket. + +PACKET.PROTOCOL <``string``>:: +L3 protocol associated with the packet socket. + +PARTITION <``string``>:: +Block device name resolved by `/proc/partition`. + +PID <``number``>:: +PID of the process opening the file. + +PIDFD.COMM <``string``>:: +Command of the process targeted by the pidfd. + +PIDFD.NSPID <``string``>:: +Value of NSpid field in ``/proc/``_pid_``/fdinfo/``_fd_ of the pidfd. ++ +Quoted from kernel/fork.c of Linux source tree: ++ +____ +If pid namespaces are supported then this function will also print +the pid of a given pidfd refers to for all descendant pid namespaces +starting from the current pid namespace of the instance, i.e. the +Pid field and the first entry in the NSpid field will be identical. + +Note that this differs from the Pid and NSpid fields in +/proc/<pid>/status where Pid and NSpid are always shown relative to +the pid namespace of the procfs instance. +____ + +PIDFD.PID <``number``>:: +PID of the process targeted by the pidfd. + +PING.ID <`number`>:: +ICMP echo request id used on the PING socket. + +POS <``number``>:: +File position. + +RAW.PROTOCOL <``number``>:: +Protocol number of the raw socket. + +RDEV <``string``>:: +Device ID (if special file). + +SIZE <``number``>:: +File size. + +SOCK.LISTENING <``boolean``>:: +Listening socket. + +SOCK.NETS <``number``>:: +Inode identifying network namespace where the socket belongs to. + +SOCK.PROTONAME <``string``>:: +Protocol name. + +SOCK.STATE <``string``>:: +State of socket. + +SOCK.TYPE <``string``>:: +Type of socket. Here type means the second parameter of +socket system call: ++ +* stream +* dgram +* raw +* rdm +* seqpacket +* dccp +* packet + +SOURCE <``string``>:: +File system, partition, or device containing the file. + +STTYPE <``string``>:: +Raw file types returned from *stat*(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN. + +TCP.LADDR <``string``>:: +Local L3 (INET.LADDR or INET6.LADDR) address and local TCP port. + +TCP.LPORT <``integer``>:: +Local TCP port. + +TCP.RADDR <``string``>:: +Remote L3 (INET.RADDR or INET6.RADDR) address and remote TCP port. + +TCP.RPORT <``integer``>:: +Remote TCP port. + +TID <``number``>:: +Thread ID of the process opening the file. + +TYPE <``string``>:: +Cooked version of STTYPE. It is same as STTYPE with exceptions. +For SOCK, print the value for SOCK.PROTONAME. +For UNKN, print the value for AINODECLASS if SOURCE is anon_inodefs. + +UDP.LADDR <``string``>:: +Local IP address and local UDP port. + +UDP.LPORT <``integer``>:: +Local UDP port. + +UDP.RADDR <``string``>:: +Remote IP address and remote UDP port. + +UDP.RPORT <``integer``>:: +Remote UDP port. + +UDPLITE.LADDR <``string``>:: +Local IP address and local UDPLite port. + +UDPLITE.LPORT <``integer``>:: +Local UDP port. + +UDPLITE.RADDR <``string``>:: +Remote IP address and remote UDPLite port. + +UDPLITE.RPORT <``integer``>:: +Remote UDP port. + +UID <``number``>:: +User ID number. + +UNIX.PATH <``string``>:: +Filesystem pathname for UNIX domain socket. + +USER <``string``>:: +User of the process. + +== FILTER EXPRESSION + +*lsfd* evaluates the expression passed to *--filter* option every time +before printing a file line. *lsfd* prints the line only if the result +of evaluation is `true`. + +An expression consists of column names, literals and, operators like: +`DELETED`, `(PID == 1)`, `(NAME == "/etc/passwd")`, `(PID == 1) && DELETED`. +`DELETED`, `PID`, and `NAME` are column names in the example. +`1` and "/etc/passwd" are literals. +`==` and `&&` are operators. + +Before evaluation, *lsfd* substitutes column names in the given +expression with actual column values in the line. There are three +different data types: `boolean`, `string`, and `number`. For columns +with a `boolean` type, the value can be stand-alone. For `string` and +`number` values, the value must be an operand of an operator, for +example, `(PID == 1)`. See *OUTPUT COLUMNS* about the types of +columns. + +Literal is for representing a value directly. See BOOLLIT, STRLIT, and +NUMLIT. Different data types have different literal syntax. + +An operator works with one or two operand(s). An operator has an +expectation about the data type(s) of its operands. Giving an +unexpected data type to an operator causes a syntax error. + +Operators taking two operands are `and`, `or`, `eq`, `ne`, `le`, `lt`, `ge`, `gt`, `=~`, `!~`. +Alphabetically named operators have C-language +flavored aliases: `&&`, `||`, `==`, `!=`, `<`, `<=`, `>=`, and `>`. + +`!` is the only operator that takes one operand. + +`eq`, `ne`, and their aliases expect operands have the same data type. +Applying these operators return a `boolean`. + +`and`, `or`, `not` and their aliases expect operands have `boolean` data +type. Applying these operators return a `boolean`. + +`lt`, `le`, `gt`, `ge`, and their aliases expect operands have +`number` data types. Applying these operators return a `boolean`. + +`=~` is for regular expression matching; if a string at the right side +matches a regular expression at the left side, the result is true. +The right side operand must be a string literal. See STRLIT about the +syntax. + +`!~` is a short-hand version of `not (STR =~ PAT)`; it inverts the +result of `=~`. + +=== Limitations + +The current implementation does not define precedences within +operators. Use `(` and `)` explicitly for grouping the +sub-expressions if your expression uses more than two operators. + +About `number` typed values, the filter engine supports only +non-negative integers. + +=== Semi-formal syntax + +//TRANSLATORS: In the following messages, translate only the <``variables``>. +EXPR :: BOOLEXP + +BOOLEXP0 :: COLUMN <``boolean``> | BOOLLIT | _(_ BOOLEXP _)_ + +BOOLEXP :: BOOLEXP0 | BOOLOP1 | BOOLOP2 | BOOLOP2BL | BOOLOP2CMP | BOOLOP2REG + +COLUMN :: [\_A-Za-z][-_:A-Za-z0-9]* + +BOOLOP1 :: _!_ BOOLEXP0 | _not_ BOOLEXP0 + +STREXP :: COLUMN <``string``> | STRLIT + +NUMEXP :: COLUMN <``number``> | NUMLIT + +BOOLLIT :: _true_ | _false_ + +CHARS :: ( [^\] | _\\_ | _\'_ | _\"_ )* + +STRLIT :: _'_ CHARS _'_ | _"_ CHARS _"_ + +NUMLIT :: [1-9][0-9]* | _0_ + +BOOLOP2 :: STREXP OP2 STREXP | NUMEXP OP2 NUMEXP | BOOLEXP0 OP2 BOOLEXP0 + +OP2 :: _==_ | _eq_ | _!=_ | _ne_ + +BOOLOP2BL :: BOOLEXP0 OP2BL BOOLEXP0 + +OP2BL :: _&&_ | _and_ | _||_ | _or_ + +BOOLOP2CMP :: NUMEXP OP2CMP NUMEXP + +OP2CMP :: _<_ | _lt_ | _\<=_ | _le_ | _>_ | _gt_ | _>=_ | _ge_ + +BOOLOP2REG :: STREXP OP2REG STRLIT + +OP2REG :: _=~_ | _!~_ + +== FILTER EXAMPLES + +*lsfd* has few options for filtering. In most of cases, what you should +know is *-Q* (or *--filter*) option. Combined with *-o* (or +*--output*) option, you can customize the output as you want. + +//TRANSLATORS: In the following messages, don't forget to add whitespace at the end! +List files associated with PID 1 and PID 2 processes: :: +.... +# lsfd -Q '(PID == 1) or (PID == 2)' +.... + +Do the same in an alternative way: :: +.... +# lsfd -Q '(PID == 1) || (PID == 2)' +.... + +Do the same in a more efficient way: :: +.... +# lsfd --pid 1,2 +.... + +Whitescapes can be used instead of a comma: :: +.... +# lsfd --pid '1 2' +.... + +Utilize *pidof*(1) for list the files associated with "firefox": :: +.... +# lsfd --pid "$(pidof firefox)" +.... + +List the 1st file descriptor opened by PID 1 process: :: +.... +# lsfd -Q '(PID == 1) and (FD == 1)' +.... + +Do the same in an alternative way: :: +.... +# lsfd -Q '(PID == 1) && (FD == 1)' +.... + +List all running executables: :: +.... +# lsfd -Q 'ASSOC == "exe"' +.... + +Do the same in an alternative way: :: +.... +# lsfd -Q 'ASSOC eq "exe"' +.... + +Do the same but print only file names: :: +.... +# lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u +.... + +List deleted files associated to processes: :: +.... +# lsfd -Q 'DELETED' +.... + +List non-regular files: :: +.... +# lsfd -Q 'TYPE != "REG"' +.... + +List block devices: :: +.... +# lsfd -Q 'DEVTYPE == "blk"' +.... + +Do the same with TYPE column: :: +.... +# lsfd -Q 'TYPE == "BLK"' +.... + +List files including "dconf" directory in their names: :: +.... +# lsfd -Q 'NAME =~ ".\*/dconf/.*"' +.... + +List files opened in a QEMU virtual machine: :: +.... +# lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)' +.... + +Hide files associated to kernel threads: :: +.... +# lsfd -Q '!KTHREAD' +.... + +== COUNTER EXAMPLES + +Report the numbers of netlink socket descriptors and unix socket descriptors: :: +.... +# lsfd --summary=only \ + -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \ + -C 'unix sockets':'(NAME =~ "UNIX:.*")' +VALUE COUNTER + 57 netlink sockets + 1552 unix sockets +.... + +Do the same but print in JSON format: :: +.... +# lsfd --summary=only --json \ + -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \ + -C 'unix sockets':'(NAME =~ "UNIX:.*")' +{ + "lsfd-summary": [ + { + "value": 15, + "counter": "netlink sockets" + },{ + "value": 798, + "counter": "unix sockets" + } + ] +} +.... + + +== HISTORY + +The *lsfd* command is part of the util-linux package since v2.38. + +== AUTHORS + +mailto:yamato@redhat.com[Masatake YAMATO], +mailto:kzak@redhat.com[Karel Zak] + +== SEE ALSO + +*lsof*(8) +*pidof*(1) +*proc*(5) +*socket*(2) +*stat*(2) + +include::man-common/bugreports.adoc[] + +include::man-common/footer.adoc[] + +ifdef::translation[] +include::man-common/translation.adoc[] +endif::[] |