Swiss Army Knife of Unix Debugging: lsof | Hacker News Reader

Swiss Army Knife of Unix Debugging: lsof

catonmat.net

130 pointspkrumins27 comments

Don't forget that you can use lsof to undelete files (provided that at least one process still has the file open): http://www.linux.com/archive/articles/58142

I think your post is actually more useful than the article.

Excellent! I think I know Unix pretty well, but it would be great if someone had a directory of common use scenarios that one could look through, rather than using Google and wading through horrible forum posts...

Not completely sure what you're asking for, here, but Command Line Fu might be in the ball park:

http://www.commandlinefu.com/commands/browse

doesn't seem like that's possible in OS X due to no /proc natively. I'm going to see if I can do it with MacFUSE & procfs..

You don't have to use lsof for that. Just find the pid of the process that has it open, then cd /proc/<pid>/fd and then ls -l

lsof doesn't really do anything for you if you know the pid already. (But it's great if you don't know the pid.)

Then, look through the list for your file, and copy the file descriptor just like in the article.

This is true, but only in the kinda trivial sense that lsof is just a pretty front end to the /proc filesystem. The same is true of pmap and netstat, but they remain useful tools nonetheless.

lsof predates the proc filesystem if I recall correctly

Indeed. lsof is available on OS X too, which doesn't have /proc.

If you feel that lsof is the swiss army knife of unix debugging, then you haven't done much serious unix debugging. Don't get me wrong, lsof is useful and even indispensable in some situations, but not exactly be-all-end-all.

DTrace fits that description much closer, even though its only available for OpenSolaris, OS X, I believe FreBSD has a port and Linux is getting one.

edit: also see: strace, ltrace, gdb, truss

Yeah, the headline is a poor analogy for an otherwise well-written and useful atricle.

You'd use SystemTap for kernel-level tracing and breakpoint debugging on Linux. Check the wiki for a bunch of useful pre-cut tap files.

Linux does indeed have a port of dtrace, but it's not legal due to Sun's license.

OS X has a port of DTrace, so I doubt licensing is a big issue.

What he meant to say is that it's not legal because of Linux's license.

Not at all. The GPL is a much older license than the Sun CDDL, which mainly seems to have been created to stop any useful code from Solaris entering Linux.

OS X's kernel (Mach) isn't GPL licensed.

Thats the first thing that came to my mind when I read it as well. DTrace (and strace to a lesser extent) are the first things which come to mind whenever you've got to debug anything or atleast get a clue about whats going on in a runaway process.

Two swiss knives for me then. One in the right pocket, the other in the left. ;)

Gonna write about strace in one of the next articles. And possibly also about dtrace in another article.

I just sent him 'The Seasoned Schemer'. If anyone wants to send him 'The Reasoned Schemer', I'm sure he'd appreciate it, will be about $30 incl. int'l shipping. I know I really appreciate his posts. http://www.amazon.com/gp/registry/wishlist/QDKYO6OQUU4O?reve...

Thanks for "The Seasoned Schemer" book! You are absolutely right that I'd also appreciate "The Reasoned Schemer". :)

While you could send him The Reasoned Schemer (I already sold my copy), IMHO _The Art of Prolog_ is a far better book for learning the same material (logic programming, declarative programming, DSLs). Whatever you think about Prolog, it's as deep a book as SICP. Seriously wonderful. (O'Keefe's _The Craft of Prolog_ is a good follow-up.)

It's nice to have a hardbound copy of the newest edition, but the previous edition is available for comparatively cheap (US$6), and torrents of both seem to get around. FYI.

I had never heard about "The Art of Prolog". Gonna check it out!

Someone has bought me "The Reasoned Schemer"! :)

I will now have all three books, reasoned, seasoned and little schemer. :)

Huge thanks to the person who bought the reasoned schemer!

Merry Christmas!

Warning: lsof can cause a kernel panic in OSX. I haven't tested it since leopard, but if you loop lsof continuously you'll hit it. There's some kind of race condition.

One of the reasons that advanced lsof usage isn't that common is that the Linux man page for it so dense, and a bunch of details you don't need to get started using it are in the first few pages. I've tried a number of times to get all the way through it and have never finished. Thankfully there are some examples at the end.

As long as everybody is learning about lsof this week, you might also want to check out a similar utility, fuser, which lists which processes are using a particular file.

http://linuxcommand.org/man_pages/fuser1.html

It's really handy for some situations. For instance, if a process can't grab some port, you can use fuser to quickly determine which process grabbed it first.

I run into this a lot.

Port is in use 8003.

lsof -i :8003

Then I kill whatever process was on 8003. I do this a lot with my Django development if I didn't kill the server right the first time.

Reply on news.ycombinator.com