LSFD(1) LSFD(1) lsfd - lsfd [] lsfd lsof(8) . lsof-, lsfd ; . lsfd lsof; . . , . --output - . lsfd ,,Libsmartcols" . --output , --filter . lsfd --help . -l, --threads . -J, --json . -n, --noheadings . -o, --output . . + (., lsfd -o +DELETED). -r, --raw . --notruncate . -p, --pid . pids -. . pidof(1). . , -Q , . ,,-Q ( == 1)", -p, . ,,-p 1", , -p -p -Q. -i[4|6], --inet[=4|=6] IPv4 / IPv6 . -Q, --filter . scols-filter(5) . -C, --counter :_ --summary . lsfd . , lsfd _, . lsfd --filter ; . scols-filter(5) _. ,,{" ,,:". . . --summary[=when] . only, append ili never. , only. . . --counter . , lsfd ( ) . : --summary --json . --summary=only --json. --debug-filter . lsfd . --dump-counters --summary. --hyperlink[=mode] Print paths as terminal hyperlinks. The mode can be set to "always", "never", or "auto". The optional argument when can be set to "auto", "never", or "always". If the when argument is omitted, it will default to "auto". The "auto" setting means that hyperlinks will only be used if the output is on a terminal. -H, --list-columns --output. -h, --help . -V, --version Display version and exit. . < >. : . . AINODECLASS <> -. <> . <> ,,/proc/devices". BPF-MAP.ID <> . -. <> ,,bpf" . .-. <> (). . <> . .- <> . BPF-PROG.TAG Bpf program TAG. .- <> ,,bpf" . .-. <> (). <> ,,/proc/devices". <> . <> . <> . <> (blk, char, nodev). ENDPOINTS IPC . lsfd lsfd ; lsfd -p. . , -, ,,ptmx" ,,pts" ,,[-r][-w] The last characters ([-r][-w]) represent the read and/or write mode of the endpoint. ,, UNIX-STREAM ,,[-r?][-w?] ([-r?][-w?]), .. _ <> . EVENTPOLL.TFDS <> ,,eventpoll" . <> . <> . <> . . <> . . <> . 6. <> 6 . 6. <> 6 . - <> -. INOTIFY.- <> INOTIFY.INODES.RAW-. --,--. INOTIFY.-. <> - . --,-:-. <> ,,/proc/",,/fd/" ,,/proc/",,/map_files/". <> . MAJ:MIN <> , . <> ( ). <> ,,/proc/misc". <> . <> (rwx). <> -. . : AF_VSOCK state=SOCK.STATE type=SOCK.TYPE laddr=VSOCK.LADDR[ raddr=VSOCK.RADDR] raddr is not shown for listening sockets. - =.- =.-[ =.] - id=BPF-PROG.ID type=BPF-PROG.TYPE tag= BPF-PROG.TAG [ name=BPF.NAME] eventpoll tfds=EVENTPOLL.TFDS eventfd =. inotify -=INOTIFY.- : iface=TUN.IFACE protocol=NETLINK.PROTOCOL[ lport=NETLINK.LPORT[ group=NETLINK.GROUPS]] type=SOCK.TYPE[ protocol=PACKET.PROTOCOL][ iface=PACKET.IFACE] pidfd pid=TARGET-PID comm=TARGET-COMMAND nspid=TARGET-NSPIDS lsfd TARGET-PID TARGET-NSPIDS ,,/proc/",,/fdinfo/". state=SOCK.STATE[ id=PING.ID][ laddr=INET.LADDR [ raddr=INET.RADDR]] 6 state=SOCK.STATE[ id=PING.ID][ laddr=INET6.LADDR [ raddr=INET6.RADDR]] ptmx tty-index=PTMX.TTY-INDEX lsfd TARGET-PID TARGET-NSPIDS ,,/proc/",,/fdinfo/". RAW state=SOCK.STATE[ protocol=RAW.PROTOCOL [ laddr=INET.LADDR [ raddr=INET.RADDR]]] RAWv6 state=SOCK.STATE[ protocol=RAW.PROTOCOL [ laddr=INET6.LADDR [ raddr=INET6.RADDR]]] _ mask=. TCP, TCPv6 state=SOCK.STATE[ laddr=TCP.LADDR [ raddr=TCP.RADDR]] timerfd clockid=TIMERFD.CLOCKID[ =TIMERFD.REMAINING [ =TIMERFD.INTERVAL]] UDP, UDPv6 state=SOCK.STATE[ laddr=UDP.LADDR [ raddr=UDP.RADDR]] lsfd ,,raddr=" UDP.RADDR ,,0.0.0.0" UDP.RPORT 0. UDP-LITE, UDPLITEv6 state=SOCK.STATE[ laddr=UDPLITE.LADDR [ raddr=UDPLITE.RADDR]] UNIX-STREAM state=SOCK.STATE[ path=UNIX.PATH] UNIX state=SOCK.STATE[ path=UNIX.PATH] type=SOCK.TYPE ,,()" . -, , X- . . <>> . . <>> . . <>> . <> . . <> (NS.TYPE:[INODE]) . . <> . ,,mnt", ,,cgroup", ,,uts", ,,ipc", ,,user", ,,pid", ,,net", ,,time" ,,unknown". <> . .IFACE <> . . <> L3 . <> ,,/proc/partition". <> . . <> ,,pidfd"-. . <> NSpid ,,/proc/"pid,,/fdinfo/"fd ,,pidfd"-. ,,/fork.c" : , ,,pidfd"- , . ,,NSpid" . ,,Pid" ,,NSpid" ,,/proc/<>/" ,,procfs" . . <> ,,pidfd"-. . <> ICMP PING . <> . RAW.PROTOCOL <> . RDEV <> ( ). . <> . <> . SOCK.LISTENING <> . SOCK.NETS <> - . SOCK.PROTONAME <> . . <> . [-r?] r, . -, . ?, . [-w?] w, . -, . ?, . SOCK.STATE <> . SOCK.TYPE <> . : o stream o dgram o raw o rdm o seqpacket o dccp o <> File system, partition, or device containing the file. For the association having ERROR as the value for TYPE column, lsfd fills this column with syscall:_errno_. STTYPE <> stat(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, UNKN. TCP.LADDR <> L3 (INET.LADDR INET6.LADDR) TCP . TCP.LPORT <> TCP . TCP.RADDR <> L3 (INET.RADDR INET6.RADDR) TCP . TCP.RPORT <> TCP . <> . . <> _. . <> . . <> . PTMX.TTY-INDEX <> TTY . TUN.IFACE <> . <> STTYPE-. STTYPE . , SOCK.PROTONAME. , AINODECLASS ,,anon_inodefs". If lsfd gets an error when calling a syscall to know about a target file descriptor, lsfd fills this column for it with ERROR. UDP.LADDR <> UDP . UDP.LPORT <> UDP . UDP.RADDR <> UDP . UDP.RPORT <> UDP . UDPLITE.LADDR <> UDPLite . UDPLITE.LPORT <> UDP . UDPLITE.RADDR <> UDPLite . UDPLITE.RPORT <> UDP . <> . UNIX. <> . <> . VSOCK.LADDR , VSOCK.RADDR Local VSOCK address. The format of the element is VSOCK.LCID:VSOCK.LPORT. Well-known CIDs will be decoded: "*", "hypervisor", "local", or "host". Well-known ports will be decoded: "*". VSOCK.LCID , VSOCK.RCID Local and remote VSOCK context identifiers. VSOCK.LPORT , VSOCK.RPORT Local and remote VSOCK ports. X- <> -. ; X- lsfd / . [-r] . -. [-w] . -. [-x] . . [-D] . . [-Ll] . l , . L . / / , L . [-m] . ,,eventpoll" (select, pselect, poll, ppoll), . , lsfd m . restart_syscall(2). lsfd . , -Q ( --filter) . -o ( --output) , . 1 2 : # lsfd -Q '(PID == 1) (PID == 2)' : # lsfd -Q '(PID == 1) || (PID == 2)' : # lsfd --pid 1,2 Whitespaces can be used instead of a comma: # lsfd --pid '1 2' pidof(1) ,,firefox": # lsfd --pid "$(pidof firefox)" 1 1 : # lsfd -Q '(PID == 1) (FD == 1)' : # lsfd -Q '(PID == 1) && (FD == 1)' : # lsfd -Q 'ASSOC == "exe"' : # lsfd -Q 'ASSOC eq "exe"' : # lsfd -o NAZIV -Q 'ASSOC eq "exe"' | sort -u : # lsfd -Q 'DELETED' - : # lsfd -Q 'TYPE != "REG"' : # lsfd -Q 'DEVTYPE == "blk"' : # lsfd -Q 'TYPE == "BLK"' ,,dconf" : # lsfd -Q 'NAME =~ ".\*/dconf/.*"' QEMU : # lsfd -Q '(COMMAND =~ ".\*qemu.*") (FD >= 0)' 0.5 : # lsfd -Q '(TIMERFD. < 0.5) (TIMERFD. > 0.0)' List processes communicating via unix stream sockets: # lsfd -Q 'TYPE == "UNIX-STREAM" && UNIX.PATH =~ ".+"' -oUNIX.PATH,PID,COMMAND,FD,SOCK.STATE,ENDPOINTS List processes communicating via a specified unix stream socket: # lsfd -Q 'TYPE == "UNIX-STREAM" && UNIX.PATH == "@/tmp/.X11-unix/X0"' -oUNIX.PATH,PID,COMMAND,FD,SOCK.STATE,ENDPOINTS : # lsfd --summary=only \ -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \ -C 'unix sockets':'(NAME =~ "UNIX:.*")' 57 netlink sockets 1552 unix sockets : # lsfd --summary=only --json \ -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \ -C 'unix sockets':'(NAME =~ "UNIX:.*")' { "lsfd-summary": [ { "value": 15, "counter": "netlink sockets" },{ "value": 798, "counter": "unix sockets" } ] } lsfd ,,util-linux" v2.38. Masatake YAMATO , Karel Zak bpftool(8), bps(8), lslocks(8), lsof(8), pidof(1), proc(5), scols-filter(5), socket(2), ss(8), stat(2), vsock(7) For bug reports, use the issue tracker . lsfd ,,util-linux" . util-linux 2.41 2025-03-29 LSFD(1)