diff options
Diffstat (limited to 'misc-utils/lsfd.1')
| -rw-r--r-- | misc-utils/lsfd.1 | 1110 |
1 files changed, 1110 insertions, 0 deletions
diff --git a/misc-utils/lsfd.1 b/misc-utils/lsfd.1 new file mode 100644 index 0000000..9baaa42 --- /dev/null +++ b/misc-utils/lsfd.1 @@ -0,0 +1,1110 @@ +'\" t +.\" Title: lsfd +.\" Author: [see the "AUTHOR(S)" section] +.\" Generator: Asciidoctor 2.0.20 +.\" Date: 2023-12-01 +.\" Manual: User Commands +.\" Source: util-linux 2.39.3 +.\" Language: English +.\" +.TH "LSFD" "1" "2023-12-01" "util\-linux 2.39.3" "User Commands" +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.ss \n[.ss] 0 +.nh +.ad l +.de URL +\fI\\$2\fP <\\$1>\\$3 +.. +.als MTO URL +.if \n[.g] \{\ +. mso www.tmac +. am URL +. ad l +. . +. am MTO +. ad l +. . +. LINKSTYLE blue R < > +.\} +.SH "NAME" +lsfd \- list file descriptors +.SH "SYNOPSIS" +.sp +\fBlsfd\fP [option] +.SH "DESCRIPTION" +.sp +\fBlsfd\fP is intended to be a modern replacement for \fBlsof\fP(8) on Linux systems. +Unlike \fBlsof\fP, \fBlsfd\fP is specialized to Linux kernel; it supports Linux +specific features like namespaces with simpler code. \fBlsfd\fP is not a +drop\-in replacement for \fBlsof\fP; they are different in the command line +interface and output formats. +.sp +The default output is subject to change. So whenever possible, you should avoid using +default outputs in your scripts. Always explicitly define expected columns by using +\fB\-\-output\fP \fIcolumns\-list\fP in environments where a stable output is required. +.sp +\fBlsfd\fP uses Libsmartcols for output formatting and filtering. See the description of \fB\-\-output\fP +option for customizing the output format, and \fB\-\-filter\fP option for filtering. Use \fBlsfd \-\-help\fP +to get a list of all available columns. +.SH "OPTIONS" +.sp +\fB\-l\fP, \fB\-\-threads\fP +.RS 4 +List in threads level. +.RE +.sp +\fB\-J\fP, \fB\-\-json\fP +.RS 4 +Use JSON output format. +.RE +.sp +\fB\-n\fP, \fB\-\-noheadings\fP +.RS 4 +Don\(cqt print headings. +.RE +.sp +\fB\-o\fP, \fB\-\-output\fP \fIlist\fP +.RS 4 +Specify which output columns to print. See the \fBOUTPUT COLUMNS\fP +section for details of available columns. +.sp +The default list of columns may be extended if \fIlist\fP is specified in +the format +\fIlist\fP (e.g., \fBlsfd \-o +DELETED\fP). +.RE +.sp +\fB\-r\fP, \fB\-\-raw\fP +.RS 4 +Use raw output format. +.RE +.sp +\fB\-\-notruncate\fP +.RS 4 +Don\(cqt truncate text in columns. +.RE +.sp +\fB\-p\fP, \fB\-\-pid\fP \fIpids\fP +.RS 4 +Collect information only for specified processes. +\fIpids\fP is a list of pids. A comma or whitespaces can be used as separators. +You can use this option with \fBpidof\fP(1). See \fBFILTER EXAMPLES\fP. +.sp +Both \fB\-Q\fP option with an expression including PID, e.g. \-Q (PID == 1), +and \fB\-p\fP option, e.g. \-p 1, may print the same output but using \fB\-p\fP +option is much more efficient because \fB\-p\fP option works at a much earlier +stage of processing than the \fB\-Q\fP option. +.RE +.sp +\fB\-i\fP[4|6], \fB\-\-inet\fP[=4|=6] +.RS 4 +List only IPv4 sockets and/or IPv6 sockets. +.RE +.sp +\fB\-Q\fP, \fB\-\-filter\fP \fIexpr\fP +.RS 4 +Print only the files matching the condition represented by the \fIexpr\fP. +See also \fBFILTER EXAMPLES\fP. +.RE +.sp +\fB\-C\fP, \fB\-\-counter\fP \fIlabel\fP:\fIfilter_expr\fP +.RS 4 +Define a custom counter used in \fB\-\-summary\fP output. \fBlsfd\fP makes a +counter named \fIlabel\fP. During collect information, \fBlsfd\fP counts files +matching \fIfilter_expr\fP, and stores the counted number to the +counter named \fIlabel\fP. \fBlsfd\fP applies filters defined with \fB\-\-filter\fP +options before counting; files excluded by the filters are not counted. +.sp +See \fBFILTER EXPRESSION\fP about \fIfilter_expr\fP. +\fIlabel\fP should not include \f(CR{\fP nor \f(CR:\fP. You can define multiple +counters by specifying this option multiple times. +.sp +See also \fBCOUNTER EXAMPLES\fP. +.RE +.sp +\fB\-\-summary\fP[=\fIwhen\fP] +.RS 4 +This option controls summary lines output. The optional argument \fIwhen\fP +can be \fBonly\fP, \fBappend\fP or \fBnever\fP. If the \fIwhen\fP argument is omitted, +it defaults to \fBonly\fP. +.sp +The summary reports counters. A counter consists of a label and an +integer value. \fB\-\-counter\fP is the option for defining a counter. If +a user defines no counter, \fBlsfd\fP uses the definitions of pre\-defined +built\-in counters (default counters) to make the summary output. +.sp +CAUTION: Using \fB\-\-summary\fP and \fB\-\-json\fP may make the output broken. Only combining \fB\-\-summary\fP=\fBonly\fP and \fB\-\-json\fP is valid. +.RE +.sp +\fB\-\-debug\-filter\fP +.RS 4 +Dump the internal data structure for the filter and exit. This is useful +only for \fBlsfd\fP developers. +.RE +.sp +\fB\-\-dump\-counters\fP +.RS 4 +Dump the definition of counters used in \fB\-\-summary\fP output. +.RE +.sp +\fB\-h\fP, \fB\-\-help\fP +.RS 4 +Display help text and exit. +.RE +.sp +\fB\-V\fP, \fB\-\-version\fP +.RS 4 +Print version and exit. +.RE +.SH "OUTPUT COLUMNS" +.sp +Each column has a type. Types are surround by < and >. +.sp +CAUTION: The names and types of columns are not stable yet. +They may be changed in the future releases. +.sp +AINODECLASS <\f(CRstring\fP> +.RS 4 +Class of anonymous inode. +.RE +.sp +ASSOC <\f(CRstring\fP> +.RS 4 +Association between file and process. +.RE +.sp +BLKDRV <\f(CRstring\fP> +.RS 4 +Block device driver name resolved by \f(CR/proc/devices\fP. +.RE +.sp +CHRDRV <\f(CRstring\fP> +.RS 4 +Character device driver name resolved by \f(CR/proc/devices\fP. +.RE +.sp +COMMAND <\f(CRstring\fP> +.RS 4 +Command of the process opening the file. +.RE +.sp +DELETED <\f(CRboolean\fP> +.RS 4 +Reachability from the file system. +.RE +.sp +DEV <\f(CRstring\fP> +.RS 4 +ID of the device containing the file. +.RE +.sp +DEVTYPE <\f(CRstring\fP> +.RS 4 +Device type (\f(CRblk\fP, \f(CRchar\fP, or \f(CRnodev\fP). +.RE +.sp +ENDPOINT <\f(CRstring\fP> +.RS 4 +IPC endpoints information communicated with the fd. +The format of the column depends on the object associated +with the fd: +.sp +FIFO type +.RS 4 +\fIPID\fP,\fICOMMAND\fP,\fIASSOC\fP[\-r][\-w] +.sp +The last characters ([\-r][\-w]) represents the read and/or +write mode of the endpoint. +.RE +.sp +\fBlsfd\fP collects endpoints within the processes that +\fBlsfd\fP scans; \fBlsfd\fP may miss some endpoints +if you limits the processes with \fB\-p\fP option. +.RE +.sp +FD <\f(CRnumber\fP> +.RS 4 +File descriptor for the file. +.RE +.sp +FLAGS <\f(CRstring\fP> +.RS 4 +Flags specified when opening the file. +.RE +.sp +FUID <\f(CRnumber\fP> +.RS 4 +User ID number of the file\(cqs owner. +.RE +.sp +INET.LADDR <\f(CRstring\fP> +.RS 4 +Local IP address. +.RE +.sp +INET.RADDR <\f(CRstring\fP> +.RS 4 +Remote IP address. +.RE +.sp +INET6.LADDR <\f(CRstring\fP> +.RS 4 +Local IP6 address. +.RE +.sp +INET6.RADDR <\f(CRstring\fP> +.RS 4 +Remote IP6 address. +.RE +.sp +INODE <\f(CRnumber\fP> +.RS 4 +Inode number. +.RE +.sp +KNAME <\f(CRstring\fP> +.RS 4 +Raw file name extracted from +from \f(CR/proc/\fP\fIpid\fP\f(CR/fd/\fP\fIfd\fP or \f(CR/proc/\fP\fIpid\fP\f(CR/map_files/\fP\fIregion\fP. +.RE +.sp +KTHREAD <\f(CRboolean\fP> +.RS 4 +Whether the process is a kernel thread or not. +.RE +.sp +MAJ:MIN <\f(CRstring\fP> +.RS 4 +Device ID for special, or ID of device containing file. +.RE +.sp +MAPLEN <\f(CRnumber\fP> +.RS 4 +Length of file mapping (in page). +.RE +.sp +MISCDEV <\f(CRstring\fP> +.RS 4 +Misc character device name resolved by \f(CR/proc/misc\fP. +.RE +.sp +MNTID <\f(CRnumber\fP> +.RS 4 +Mount ID. +.RE +.sp +MODE <\f(CRstring\fP> +.RS 4 +Access mode (rwx). +.RE +.sp +NAME <\f(CRstring\fP> +.RS 4 +Cooked version of KNAME. It is mostly same as KNAME. +.sp +Some files have special formats and information sources: +.sp +NETLINK +.RS 4 +protocol=\fINETLINK.PROTOCOL\fP[ lport=\fINETLINK.LPORT\fP[ group=\fINETLINK.GROUPS\fP]] +.RE +.sp +PACKET +.RS 4 +type=\fISOCK.TYPE\fP[ protocol=\fIPACKET.PROTOCOL\fP][ iface=\fIPACKET.IFACE\fP] +.RE +.sp +pidfd +.RS 4 +pid=\fITARGET\-PID\fP comm=\fITARGET\-COMMAND\fP nspid=\fITARGET\-NSPIDS\fP +.sp +\fBlsfd\fP extracts \fITARGET\-PID\fP and \fITARGET\-NSPIDS\fP from +\f(CR/proc/\fP\fIpid\fP\f(CR/fdinfo/\fP\fIfd\fP. +.RE +.sp +PING +.RS 4 +state=\fISOCK.STATE\fP[ id=\fIPING.ID\fP][ laddr=\fIINET.LADDR\fP [ raddr=\fIINET.RADDR\fP]] +.RE +.sp +PINGv6 +.RS 4 +state=\fISOCK.STATE\fP[ id=\fIPING.ID\fP][ laddr=\fIINET6.LADDR\fP [ raddr=\fIINET6.RADDR\fP]] +.RE +.sp +RAW +.RS 4 +state=\fISOCK.STATE\fP[ protocol=\fIRAW.PROTOCOL\fP [ laddr=\fIINET.LADDR\fP [ raddr=\fIINET.RADDR\fP]]] +.RE +.sp +RAWv6 +.RS 4 +state=\fISOCK.STATE\fP[ protocol=\fIRAW.PROTOCOL\fP [ laddr=\fIINET6.LADDR\fP [ raddr=\fIINET6.RADDR\fP]]] +.RE +.sp +TCP, TCPv6 +.RS 4 +state=\fISOCK.STATE\fP[ laddr=\fITCP.LADDR\fP [ raddr=\fITCP.RADDR\fP]] +.RE +.sp +UDP, UDPv6 +.RS 4 +state=\fISOCK.STATE\fP[ laddr=\fIUDP.LADDR\fP [ raddr=\fIUDP.RADDR\fP]] +.sp +\fBlsfd\fP hides \f(CRraddr=\fP if \fIUDP.RADDR\fP is \f(CR0.0.0.0\fP and \fIUDP.RPORT\fP is 0. +.RE +.sp +UDP\-LITE, UDPLITEv6 +.RS 4 +state=\fISOCK.STATE\fP[ laddr=\fIUDPLITE.LADDR\fP [ raddr=\fIUDPLITE.RADDR\fP]] +.RE +.sp +UNIX\-STREAM +.RS 4 +state=\fISOCK.STATE\fP[ path=\fIUNIX.PATH\fP] +.RE +.sp +UNIX +.RS 4 +state=\fISOCK.STATE\fP[ path=\fIUNIX.PATH\fP] type=\fISOCK.TYPE\fP +.RE +.RE +.sp +NETLINK.GROUPS <\f(CRnumber\fP>> +.RS 4 +Netlink multicast groups. +.RE +.sp +NETLINK.LPORT <\f(CRnumber\fP>> +.RS 4 +Netlink local port id. +.RE +.sp +NETLINK.PROTOCOL <\f(CRstring\fP>> +.RS 4 +Netlink protocol. +.RE +.sp +NLINK <\f(CRnumber\fP> +.RS 4 +Link count. +.RE +.sp +NS.NAME <\f(CRstring\fP> +.RS 4 +Name (\fINS.TYPE\fP:[\fIINODE\fP]) of the namespace specified with the file. +.RE +.sp +NS.TYPE <\f(CRstring\fP> +.RS 4 +Type of the namespace specified with the file. +The type is \f(CRmnt\fP, \f(CRcgroup\fP, \f(CRuts\fP, \f(CRipc\fP, \f(CRuser\fP, \f(CRpid\fP, \f(CRnet\fP, +\f(CRtime\fP, or \f(CRunknown\fP. +.RE +.sp +OWNER <\f(CRstring\fP> +.RS 4 +Owner of the file. +.RE +.sp +PACKET.IFACE <\f(CRstring\fP> +.RS 4 +Interface name associated with the packet socket. +.RE +.sp +PACKET.PROTOCOL <\f(CRstring\fP> +.RS 4 +L3 protocol associated with the packet socket. +.RE +.sp +PARTITION <\f(CRstring\fP> +.RS 4 +Block device name resolved by \f(CR/proc/partition\fP. +.RE +.sp +PID <\f(CRnumber\fP> +.RS 4 +PID of the process opening the file. +.RE +.sp +PIDFD.COMM <\f(CRstring\fP> +.RS 4 +Command of the process targeted by the pidfd. +.RE +.sp +PIDFD.NSPID <\f(CRstring\fP> +.RS 4 +Value of NSpid field in \f(CR/proc/\fP\fIpid\fP\f(CR/fdinfo/\fP\fIfd\fP of the pidfd. +.sp +Quoted from kernel/fork.c of Linux source tree: +.RS 3 +.ll -.6i +.sp +If pid namespaces are supported then this function will also print +the pid of a given pidfd refers to for all descendant pid namespaces +starting from the current pid namespace of the instance, i.e. the +Pid field and the first entry in the NSpid field will be identical. +.sp +Note that this differs from the Pid and NSpid fields in +/proc/<pid>/status where Pid and NSpid are always shown relative to +the pid namespace of the procfs instance. +.br +.RE +.ll +.RE +.sp +PIDFD.PID <\f(CRnumber\fP> +.RS 4 +PID of the process targeted by the pidfd. +.RE +.sp +PING.ID <`number`> +.RS 4 +ICMP echo request id used on the PING socket. +.RE +.sp +POS <\f(CRnumber\fP> +.RS 4 +File position. +.RE +.sp +RAW.PROTOCOL <\f(CRnumber\fP> +.RS 4 +Protocol number of the raw socket. +.RE +.sp +RDEV <\f(CRstring\fP> +.RS 4 +Device ID (if special file). +.RE +.sp +SIZE <\f(CRnumber\fP> +.RS 4 +File size. +.RE +.sp +SOCK.LISTENING <\f(CRboolean\fP> +.RS 4 +Listening socket. +.RE +.sp +SOCK.NETS <\f(CRnumber\fP> +.RS 4 +Inode identifying network namespace where the socket belongs to. +.RE +.sp +SOCK.PROTONAME <\f(CRstring\fP> +.RS 4 +Protocol name. +.RE +.sp +SOCK.STATE <\f(CRstring\fP> +.RS 4 +State of socket. +.RE +.sp +SOCK.TYPE <\f(CRstring\fP> +.RS 4 +Type of socket. Here type means the second parameter of +socket system call: +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +stream +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +dgram +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +raw +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +rdm +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +seqpacket +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +dccp +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +packet +.RE +.RE +.sp +SOURCE <\f(CRstring\fP> +.RS 4 +File system, partition, or device containing the file. +.RE +.sp +STTYPE <\f(CRstring\fP> +.RS 4 +Raw file types returned from \fBstat\fP(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN. +.RE +.sp +TCP.LADDR <\f(CRstring\fP> +.RS 4 +Local L3 (INET.LADDR or INET6.LADDR) address and local TCP port. +.RE +.sp +TCP.LPORT <\f(CRinteger\fP> +.RS 4 +Local TCP port. +.RE +.sp +TCP.RADDR <\f(CRstring\fP> +.RS 4 +Remote L3 (INET.RADDR or INET6.RADDR) address and remote TCP port. +.RE +.sp +TCP.RPORT <\f(CRinteger\fP> +.RS 4 +Remote TCP port. +.RE +.sp +TID <\f(CRnumber\fP> +.RS 4 +Thread ID of the process opening the file. +.RE +.sp +TYPE <\f(CRstring\fP> +.RS 4 +Cooked version of STTYPE. It is same as STTYPE with exceptions. +For SOCK, print the value for SOCK.PROTONAME. +For UNKN, print the value for AINODECLASS if SOURCE is anon_inodefs. +.RE +.sp +UDP.LADDR <\f(CRstring\fP> +.RS 4 +Local IP address and local UDP port. +.RE +.sp +UDP.LPORT <\f(CRinteger\fP> +.RS 4 +Local UDP port. +.RE +.sp +UDP.RADDR <\f(CRstring\fP> +.RS 4 +Remote IP address and remote UDP port. +.RE +.sp +UDP.RPORT <\f(CRinteger\fP> +.RS 4 +Remote UDP port. +.RE +.sp +UDPLITE.LADDR <\f(CRstring\fP> +.RS 4 +Local IP address and local UDPLite port. +.RE +.sp +UDPLITE.LPORT <\f(CRinteger\fP> +.RS 4 +Local UDP port. +.RE +.sp +UDPLITE.RADDR <\f(CRstring\fP> +.RS 4 +Remote IP address and remote UDPLite port. +.RE +.sp +UDPLITE.RPORT <\f(CRinteger\fP> +.RS 4 +Remote UDP port. +.RE +.sp +UID <\f(CRnumber\fP> +.RS 4 +User ID number. +.RE +.sp +UNIX.PATH <\f(CRstring\fP> +.RS 4 +Filesystem pathname for UNIX domain socket. +.RE +.sp +USER <\f(CRstring\fP> +.RS 4 +User of the process. +.RE +.SH "FILTER EXPRESSION" +.sp +\fBlsfd\fP evaluates the expression passed to \fB\-\-filter\fP option every time +before printing a file line. \fBlsfd\fP prints the line only if the result +of evaluation is \f(CRtrue\fP. +.sp +An expression consists of column names, literals and, operators like: +\f(CRDELETED\fP, \f(CR(PID == 1)\fP, \f(CR(NAME == "/etc/passwd")\fP, \f(CR(PID == 1) && DELETED\fP. +\f(CRDELETED\fP, \f(CRPID\fP, and \f(CRNAME\fP are column names in the example. +\f(CR1\fP and "/etc/passwd" are literals. +\f(CR==\fP and \f(CR&&\fP are operators. +.sp +Before evaluation, \fBlsfd\fP substitutes column names in the given +expression with actual column values in the line. There are three +different data types: \f(CRboolean\fP, \f(CRstring\fP, and \f(CRnumber\fP. For columns +with a \f(CRboolean\fP type, the value can be stand\-alone. For \f(CRstring\fP and +\f(CRnumber\fP values, the value must be an operand of an operator, for +example, \f(CR(PID == 1)\fP. See \fBOUTPUT COLUMNS\fP about the types of +columns. +.sp +Literal is for representing a value directly. See BOOLLIT, STRLIT, and +NUMLIT. Different data types have different literal syntax. +.sp +An operator works with one or two operand(s). An operator has an +expectation about the data type(s) of its operands. Giving an +unexpected data type to an operator causes a syntax error. +.sp +Operators taking two operands are \f(CRand\fP, \f(CRor\fP, \f(CReq\fP, \f(CRne\fP, \f(CRle\fP, \f(CRlt\fP, \f(CRge\fP, \f(CRgt\fP, \f(CR=~\fP, \f(CR!~\fP. +Alphabetically named operators have C\-language +flavored aliases: \f(CR&&\fP, \f(CR||\fP, \f(CR==\fP, \f(CR!=\fP, \f(CR<\fP, \f(CR\(lA\fP, \f(CR>=\fP, and \f(CR>\fP. +.sp +\f(CR!\fP is the only operator that takes one operand. +.sp +\f(CReq\fP, \f(CRne\fP, and their aliases expect operands have the same data type. +Applying these operators return a \f(CRboolean\fP. +.sp +\f(CRand\fP, \f(CRor\fP, \f(CRnot\fP and their aliases expect operands have \f(CRboolean\fP data +type. Applying these operators return a \f(CRboolean\fP. +.sp +\f(CRlt\fP, \f(CRle\fP, \f(CRgt\fP, \f(CRge\fP, and their aliases expect operands have +\f(CRnumber\fP data types. Applying these operators return a \f(CRboolean\fP. +.sp +\f(CR=~\fP is for regular expression matching; if a string at the right side +matches a regular expression at the left side, the result is true. +The right side operand must be a string literal. See STRLIT about the +syntax. +.sp +\f(CR!~\fP is a short\-hand version of \f(CRnot (STR =~ PAT)\fP; it inverts the +result of \f(CR=~\fP. +.SS "Limitations" +.sp +The current implementation does not define precedences within +operators. Use \f(CR(\fP and \f(CR)\fP explicitly for grouping the +sub\-expressions if your expression uses more than two operators. +.sp +About \f(CRnumber\fP typed values, the filter engine supports only +non\-negative integers. +.SS "Semi\-formal syntax" +.sp +EXPR +.RS 4 +BOOLEXP +.RE +.sp +BOOLEXP0 +.RS 4 +COLUMN <\f(CRboolean\fP> | BOOLLIT | \fI(\fP BOOLEXP \fI)\fP +.RE +.sp +BOOLEXP +.RS 4 +BOOLEXP0 | BOOLOP1 | BOOLOP2 | BOOLOP2BL | BOOLOP2CMP | BOOLOP2REG +.RE +.sp +COLUMN +.RS 4 +[_A\-Za\-z][\-_:A\-Za\-z0\-9]* +.RE +.sp +BOOLOP1 +.RS 4 +\fI!\fP BOOLEXP0 | \fInot\fP BOOLEXP0 +.RE +.sp +STREXP +.RS 4 +COLUMN <\f(CRstring\fP> | STRLIT +.RE +.sp +NUMEXP +.RS 4 +COLUMN <\f(CRnumber\fP> | NUMLIT +.RE +.sp +BOOLLIT +.RS 4 +\fItrue\fP | \fIfalse\fP +.RE +.sp +CHARS +.RS 4 +( [^\(rs] | \fI\(rs\(rs\fP | \fI\(rs\*(Aq\fP | \fI\(rs"\fP )* +.RE +.sp +STRLIT +.RS 4 +\fI\*(Aq\fP CHARS \fI\*(Aq\fP | \fI"\fP CHARS \fI"\fP +.RE +.sp +NUMLIT +.RS 4 +[1\-9][0\-9]* | \fI0\fP +.RE +.sp +BOOLOP2 +.RS 4 +STREXP OP2 STREXP | NUMEXP OP2 NUMEXP | BOOLEXP0 OP2 BOOLEXP0 +.RE +.sp +OP2 +.RS 4 +\fI==\fP | \fIeq\fP | \fI!=\fP | \fIne\fP +.RE +.sp +BOOLOP2BL +.RS 4 +BOOLEXP0 OP2BL BOOLEXP0 +.RE +.sp +OP2BL +.RS 4 +\fI&&\fP | \fIand\fP | \fI||\fP | \fIor\fP +.RE +.sp +BOOLOP2CMP +.RS 4 +NUMEXP OP2CMP NUMEXP +.RE +.sp +OP2CMP +.RS 4 +\fI<\fP | \fIlt\fP | \fI<=\fP | \fIle\fP | \fI>\fP | \fIgt\fP | \fI>=\fP | \fIge\fP +.RE +.sp +BOOLOP2REG +.RS 4 +STREXP OP2REG STRLIT +.RE +.sp +OP2REG +.RS 4 +\fI=~\fP | \fI!~\fP +.RE +.SH "FILTER EXAMPLES" +.sp +\fBlsfd\fP has few options for filtering. In most of cases, what you should +know is \fB\-Q\fP (or \fB\-\-filter\fP) option. Combined with \fB\-o\fP (or +\fB\-\-output\fP) option, you can customize the output as you want. +.sp +List files associated with PID 1 and PID 2 processes: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(Aq(PID == 1) or (PID == 2)\*(Aq +.fam +.fi +.if n .RE +.sp +Do the same in an alternative way: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(Aq(PID == 1) || (PID == 2)\*(Aq +.fam +.fi +.if n .RE +.sp +Do the same in a more efficient way: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-\-pid 1,2 +.fam +.fi +.if n .RE +.sp +Whitescapes can be used instead of a comma: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-\-pid \*(Aq1 2\*(Aq +.fam +.fi +.if n .RE +.sp +Utilize \fBpidof\fP(1) for list the files associated with "firefox": +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-\-pid "$(pidof firefox)" +.fam +.fi +.if n .RE +.sp +List the 1st file descriptor opened by PID 1 process: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(Aq(PID == 1) and (FD == 1)\*(Aq +.fam +.fi +.if n .RE +.sp +Do the same in an alternative way: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(Aq(PID == 1) && (FD == 1)\*(Aq +.fam +.fi +.if n .RE +.sp +List all running executables: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqASSOC == "exe"\*(Aq +.fam +.fi +.if n .RE +.sp +Do the same in an alternative way: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqASSOC eq "exe"\*(Aq +.fam +.fi +.if n .RE +.sp +Do the same but print only file names: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-o NAME \-Q \*(AqASSOC eq "exe"\*(Aq | sort \-u +.fam +.fi +.if n .RE +.sp +List deleted files associated to processes: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqDELETED\*(Aq +.fam +.fi +.if n .RE +.sp +List non\-regular files: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqTYPE != "REG"\*(Aq +.fam +.fi +.if n .RE +.sp +List block devices: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqDEVTYPE == "blk"\*(Aq +.fam +.fi +.if n .RE +.sp +Do the same with TYPE column: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqTYPE == "BLK"\*(Aq +.fam +.fi +.if n .RE +.sp +List files including "dconf" directory in their names: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(AqNAME =~ ".\(rs*/dconf/.*"\*(Aq +.fam +.fi +.if n .RE +.sp +List files opened in a QEMU virtual machine: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(Aq(COMMAND =~ ".\(rs*qemu.*") and (FD >= 0)\*(Aq +.fam +.fi +.if n .RE +.sp +Hide files associated to kernel threads: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-Q \*(Aq!KTHREAD\*(Aq +.fam +.fi +.if n .RE +.SH "COUNTER EXAMPLES" +.sp +Report the numbers of netlink socket descriptors and unix socket descriptors: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-\-summary=only \(rs + \-C \*(Aqnetlink sockets\*(Aq:\*(Aq(NAME =~ "NETLINK:.*")\*(Aq \(rs + \-C \*(Aqunix sockets\*(Aq:\*(Aq(NAME =~ "UNIX:.*")\*(Aq +VALUE COUNTER + 57 netlink sockets + 1552 unix sockets +.fam +.fi +.if n .RE +.sp +Do the same but print in JSON format: +.RS 4 +.RE +.sp +.if n .RS 4 +.nf +.fam C +# lsfd \-\-summary=only \-\-json \(rs + \-C \*(Aqnetlink sockets\*(Aq:\*(Aq(NAME =~ "NETLINK:.*")\*(Aq \(rs + \-C \*(Aqunix sockets\*(Aq:\*(Aq(NAME =~ "UNIX:.*")\*(Aq +{ + "lsfd\-summary": [ + { + "value": 15, + "counter": "netlink sockets" + },{ + "value": 798, + "counter": "unix sockets" + } + ] +} +.fam +.fi +.if n .RE +.SH "HISTORY" +.sp +The \fBlsfd\fP command is part of the util\-linux package since v2.38. +.SH "AUTHORS" +.sp +.MTO "yamato\(atredhat.com" "Masatake YAMATO" "," +.MTO "kzak\(atredhat.com" "Karel Zak" "" +.SH "SEE ALSO" +.sp +\fBlsof\fP(8) +\fBpidof\fP(1) +\fBproc\fP(5) +\fBsocket\fP(2) +\fBstat\fP(2) +.SH "REPORTING BUGS" +.sp +For bug reports, use the issue tracker at \c +.URL "https://github.com/util\-linux/util\-linux/issues" "" "." +.SH "AVAILABILITY" +.sp +The \fBlsfd\fP command is part of the util\-linux package which can be downloaded from \c +.URL "https://www.kernel.org/pub/linux/utils/util\-linux/" "Linux Kernel Archive" "."
\ No newline at end of file |