用戶顯示打開的檔案

# lsof -u apache |more
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
httpd   4374 apache  cwd    DIR  252,1     4096      2 /
httpd   4374 apache  rtd    DIR  252,1     4096      2 /
httpd   4374 apache  txt    REG  252,1   354816 408099 /usr/sbin/httpd
httpd   4374 apache  mem    REG  252,1     9488 408013 /usr/lib64/apr-util-1/apr_ldap-1.so
httpd   4374 apache  mem    REG  252,1    27424    907 /lib64/libnss_dns-2.12.so
httpd   4374 apache  mem    REG  252,1    65928    909 /lib64/libnss_files-2.12.so
httpd   4374 apache  mem    REG  252,1    10416 408095 /usr/lib64/httpd/modules/mod_version.so
httpd   4374 apache  mem    REG  252,1    27312 408054 /usr/lib64/httpd/modules/mod_cgi.so
httpd   4374 apache  mem    REG  252,1    22992 408061 /usr/lib64/httpd/modules/mod_disk_cache.so

[root@netkiller ~]# lsof -u www
COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF     NODE NAME
httpd   2412  www  DEL    REG                0,4             12653 /dev/zero
httpd   2412  www  mem    REG                8,2    90784  5636110 /lib64/libgcc_s-4.4.7-20120601.so.1
		

列出被打開的檔案信息,排除root用戶

[root@netkiller neo]# lsof -u ^root |more

COMMAND     PID   TID          USER   FD      TYPE             DEVICE   SIZE/OFF      NODE NAME
dbus-daem   448                dbus  cwd       DIR              253,1       4096         2 /
dbus-daem   448                dbus  rtd       DIR              253,1       4096         2 /
dbus-daem   448                dbus  txt       REG              253,1     441256    141406 /usr/bin/dbus-daemon;56822cb8 (deleted)
dbus-daem   448                dbus  DEL       REG              253,1               146439 /usr/lib64/libnss_sss.so.2;56822cb8
dbus-daem   448                dbus  DEL       REG              253,1               151203 /usr/lib64/libnss_files-2.17.so;56822cb8
dbus-daem   448                dbus  DEL       REG              253,1               151199 /usr/lib64/libdl-2.17.so;56822cb8
dbus-daem   448                dbus  DEL       REG              253,1               133002 /usr/lib64/liblzma.so.5.0.99;56822ac0
dbus-daem   448                dbus  DEL       REG              253,1               133005 /usr/lib64/libpcre.so.1.2.0;56822ac0
dbus-daem   448                dbus  DEL       REG              253,1               132825 /usr/lib64/libc-2.17.so;56822cb8
dbus-daem   448                dbus  DEL       REG              253,1               151206 /usr/lib64/librt-2.17.so;56822cb8
dbus-daem   448                dbus  DEL       REG              253,1               132851 /usr/lib64/libpthread-2.17.so;56822cb8
dbus-daem   448                dbus  DEL       REG              253,1               133622 /usr/lib64/libcap-ng.so.0.0.0;56822cb8
dbus-daem   448                dbus  mem       REG              253,1     118792    133084 /usr/lib64/libaudit.so.1.0.0
dbus-daem   448                dbus  mem       REG              253,1     147120    133015 /usr/lib64/libselinux.so.1
dbus-daem   448                dbus  mem       REG              253,1     173288    133153 /usr/lib64/libexpat.so.1.6.0
dbus-daem   448                dbus  DEL       REG              253,1               132818 /usr/lib64/ld-2.17.so;56822cb8
dbus-daem   448                dbus    0r      CHR                1,3        0t0      1028 /dev/null
dbus-daem   448                dbus    1u     unix 0xffff880426d4c740        0t0     14381 socket
dbus-daem   448                dbus    2u     unix 0xffff880426d4c740        0t0     14381 socket
dbus-daem   448                dbus    3u     unix 0xffff880428cd7800        0t0     14082 /var/run/dbus/system_bus_socket
dbus-daem   448                dbus    4u  a_inode                0,9          0      5639 [eventpoll]
dbus-daem   448                dbus    5r  a_inode                0,9          0      5639 inotify
dbus-daem   448                dbus    6u     sock                0,6        0t0     14179 protocol: NETLINK
dbus-daem   448                dbus    7u     unix 0xffff880428cd1e00        0t0     14180 socket
dbus-daem   448                dbus    8u     unix 0xffff880428cd5640        0t0     14181 socket
dbus-daem   448                dbus    9u     unix 0xffff880037101e00        0t0   5347943 /var/run/dbus/system_bus_socket
dbus-daem   448                dbus   10u     unix 0xffff8800292ae900        0t0 626418112 /var/run/dbus/system_bus_socket
dbus-daem   448                dbus   11u     unix 0xffff880426f3cec0        0t0   5345962 socket
dbus-daem   448                dbus   12u     unix 0xffff8801f8149e00        0t0 626420423 /var/run/dbus/system_bus_socket
		

[root@netkiller ~]# lsof -u ^www 
COMMAND     PID      USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
init          1      root  txt       REG                8,2    150352    2228260 /sbin/init
init          1      root  mem       REG                8,2     65928    5636192 /lib64/libnss_files-2.12.so		
		

組監控

[root@netkiller neo]# lsof -g 0
COMMAND     PID PGID USER   FD      TYPE DEVICE SIZE/OFF NODE NAME
kthreadd      2    0 root  cwd       DIR  202,1     4096    2 /
kthreadd      2    0 root  rtd       DIR  202,1     4096    2 /
kthreadd      2    0 root  txt   unknown                      /proc/2/exe
ksoftirqd     3    0 root  cwd       DIR  202,1     4096    2 /
ksoftirqd     3    0 root  rtd       DIR  202,1     4096    2 /
ksoftirqd     3    0 root  txt   unknown                      /proc/3/exe
kworker/0     5    0 root  cwd       DIR  202,1     4096    2 /
kworker/0     5    0 root  rtd       DIR  202,1     4096    2 /
kworker/0     5    0 root  txt   unknown                      /proc/5/exe
migration     7    0 root  cwd       DIR  202,1     4096    2 /
migration     7    0 root  rtd       DIR  202,1     4096    2 /
migration     7    0 root  txt   unknown                      /proc/7/exe