lsof命令和Linux下文件删除、句柄与空间释放问题 
导读：
一、用事实说话
二、关于LSOF命令的其它用法：
三、参考文档：
正文：
lsof：Finding open files with lsof
作用：查看文件被哪些进程打开
一、用事实说话
【实验】Linux下文件删除、句柄与空间释放问题
窗口1：创建test文件，并用less命令打开它
[root@monitor monitor]# echo "zhengBin is Bkeep" >> test
[root@monitor monitor]# ls –sortk
8 -rw-r--r—1 root 1 Dec 9 16:02 error.txt
120 -rw-r--r—1 root 112 Dec 10 16:38 test
[root@monitor monitor]# less test
zhengBin is Bkeep
(END)
窗口2：使用lsof命令排查问题
[root@monitor monitor]# rm –rf test
[root@monitor monitor]# lsof |grep test //注意，这里test文件已被标记为 “deleted”,但仍然被less进程锁定（pid：23253）
less 23253 root 4r REG 253,0 18 2850936 /usr/monitor/test (deleted)
[root@monitor ~]# ps -ef |grep 23253 //查看less进程的系统用户，为root！
root 23253 23042 0 17:16 pts/1 00:00:00 less test
root 23291 23256 0 17:17 pts/0 00:00:00 grep 23253
[root@monitor ~]# kill -9 23253 //杀掉该进程，系统才会释放test占用的磁盘空间。（重启系统或服务也行）
[root@monitor ~]# lsof |grep test
没有了，说明空间已被释放！
二、关于lsof命令的其它用法：
1，查看目录和文件正在被那些进程使用。
[root@monitor monitor]# umount /
umount: /: device is busy
umount: /: device is busy
[root@monitor monitor]# lsof /
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
init 1 root cwd DIR 253,0 4096 2 /
init 1 root rtd DIR 253,0 4096 2 /
init 1 root txt REG 253,0 38620 9306178 /sbin/init
init 1 root mem REG 253,0 125736 6686192 /lib/ld-2.5.so
init 1 root mem REG 253,0 1602128 6686193 /lib/libc-2.5.so
init 1 root mem REG 253,0 16428 6686196 /lib/libdl-2.5.so
init 1 root mem REG 253,0 93508 6686210 /lib/libselinux.so.1
init 1 root mem REG 253,0 242880 6686209 /lib/libsepol.so.1
migration 2 root cwd DIR 253,0 4096 2 /
migration 2 root rtd DIR 253,0 4096 2 /
ksoftirqd 3 root cwd DIR 253,0 4096 2 /
ksoftirqd 3 root rtd DIR 253,0 4096 2 /
2，查看远程ip调用了系统那些进程
[root@monitor monitor]# netstat -natp
tcp 0 1008 ::ffff:192.168.254.51:22 ::ffff:192.168.254.149:1066 ESTABLISHED 22779/0
[root@monitor monitor]# lsof -i @192.168.254.149
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 22779 root 3u IPv6 98877 TCP 192.168.254.51:ssh->192.168.254.149:fpo-fns (ESTABLISHED)
3，根据端口号查看服务名
[root@monitor monitor]# lsof -i :25
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sendmail 4653 root 4u IPv4 9307 TCP monitor:smtp (LISTEN)
4，谁在打开sendmail.pid文件？
[root@monitor run]# lsof /var/run/sendmail.pid
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sendmail 4653 root 5wW REG 253,0 33 9667079 /var/run/sendmail.pid
5，【重要】查看某个进程号所打开的所有系统文件
参数说明：
-a，所有参数都必须持有真实的文件显示
-p，进程号
-d，txt记录将被过滤掉；^ 排除的意思 (the carat [^] means exclude).
[root@monitor run]# lsof -a -p 4653 -d ^txt //【重要】
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sendmail 4653 root cwd DIR 253,0 4096 9666678 /var/spool/mqueue
sendmail 4653 root rtd DIR 253,0 4096 2 /
sendmail 4653 root mem REG 253,0 6684758 /lib/libdb-4.3.so (path inode=6684892)
sendmail 4653 root DEL REG 253,0 2107155 /usr/lib/liblber-2.3.so.0.2.15.#prelink#.1kBcGu
sendmail 4653 root DEL REG 253,0 2107070 /usr/lib/libgssapi_krb5.so.2.2.#prelink#.Y8RNd8
sendmail 4653 root mem REG 253,0 2101464 /usr/lib/libz.so.1.2.3 (path inode=2117529)
sendmail 4653 root mem REG 253,0 46680 6684713 /lib/libnss_files-2.5.so
sendmail 4653 root mem REG 253,0 14596 2162994 /usr/lib/sasl2/libanonymous.so.2.0.22
sendmail 4653 root mem REG 253,0 905200 2164220 /usr/lib/sasl2/libsasldb.so.2.0.22
sendmail 4653 root mem REG 253,0 6684723 /lib/libresolv-2.5.so (path inode=6686208)
sendmail 4653 root mem REG 253,0 6684701 /lib/libcrypt-2.5.so (path inode=6686216)
sendmail 4653 root mem REG 253,0 6684759 /lib/libkeyutils-1.2.so (path inode=6686207)
sendmail 4653 root 2w CHR 1,3 1449 /dev/null
sendmail 4653 root 3u unix 0xd45eb740 9306 socket
sendmail 4653 root 4u IPv4 9307 TCP monitor:smtp (LISTEN)
sendmail 4653 root 5wW REG 253,0 33 9667079 /var/run/sendmail.pid
6，ls命令参数解释
[root@monitor monitor]# ls –sortk
8 -rw-r--r—1 root 1 Dec 9 16:02 error.txt
120 -rw-r--r—1 root 112 Dec 10 16:38 test
参数说明：
s:第一列显示的块大小（个）；o：类似l 但不显示group； S：按文件大小排序
r：倒序； t：按时间排序 k：字节数按KB来显示
三、参考文档：
http://www.ibm.com/developerworks/aix/library/au-lsof.html
http://www.eygle.com/archives/2009/10/linux_unix_file_handle_deleted.html
http://bkeep.blog.163.com/blog/static/12341429020097155811342/
一、用事实说话
二、关于LSOF命令的其它用法：
三、参考文档：
正文：
lsof：Finding open files with lsof
作用：查看文件被哪些进程打开
一、用事实说话
【实验】Linux下文件删除、句柄与空间释放问题
窗口1：创建test文件，并用less命令打开它
[root@monitor monitor]# echo "zhengBin is Bkeep" >> test
[root@monitor monitor]# ls –sortk
8 -rw-r--r—1 root 1 Dec 9 16:02 error.txt
120 -rw-r--r—1 root 112 Dec 10 16:38 test
[root@monitor monitor]# less test
zhengBin is Bkeep
(END)
窗口2：使用lsof命令排查问题
[root@monitor monitor]# rm –rf test
[root@monitor monitor]# lsof |grep test //注意，这里test文件已被标记为 “deleted”,但仍然被less进程锁定（pid：23253）
less 23253 root 4r REG 253,0 18 2850936 /usr/monitor/test (deleted)
[root@monitor ~]# ps -ef |grep 23253 //查看less进程的系统用户，为root！
root 23253 23042 0 17:16 pts/1 00:00:00 less test
root 23291 23256 0 17:17 pts/0 00:00:00 grep 23253
[root@monitor ~]# kill -9 23253 //杀掉该进程，系统才会释放test占用的磁盘空间。（重启系统或服务也行）
[root@monitor ~]# lsof |grep test
没有了，说明空间已被释放！
二、关于lsof命令的其它用法：
1，查看目录和文件正在被那些进程使用。
[root@monitor monitor]# umount /
umount: /: device is busy
umount: /: device is busy
[root@monitor monitor]# lsof /
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
init 1 root cwd DIR 253,0 4096 2 /
init 1 root rtd DIR 253,0 4096 2 /
init 1 root txt REG 253,0 38620 9306178 /sbin/init
init 1 root mem REG 253,0 125736 6686192 /lib/ld-2.5.so
init 1 root mem REG 253,0 1602128 6686193 /lib/libc-2.5.so
init 1 root mem REG 253,0 16428 6686196 /lib/libdl-2.5.so
init 1 root mem REG 253,0 93508 6686210 /lib/libselinux.so.1
init 1 root mem REG 253,0 242880 6686209 /lib/libsepol.so.1
migration 2 root cwd DIR 253,0 4096 2 /
migration 2 root rtd DIR 253,0 4096 2 /
ksoftirqd 3 root cwd DIR 253,0 4096 2 /
ksoftirqd 3 root rtd DIR 253,0 4096 2 /
2，查看远程ip调用了系统那些进程
[root@monitor monitor]# netstat -natp
tcp 0 1008 ::ffff:192.168.254.51:22 ::ffff:192.168.254.149:1066 ESTABLISHED 22779/0
[root@monitor monitor]# lsof -i @192.168.254.149
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 22779 root 3u IPv6 98877 TCP 192.168.254.51:ssh->192.168.254.149:fpo-fns (ESTABLISHED)
3，根据端口号查看服务名
[root@monitor monitor]# lsof -i :25
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sendmail 4653 root 4u IPv4 9307 TCP monitor:smtp (LISTEN)
4，谁在打开sendmail.pid文件？
[root@monitor run]# lsof /var/run/sendmail.pid
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sendmail 4653 root 5wW REG 253,0 33 9667079 /var/run/sendmail.pid
5，【重要】查看某个进程号所打开的所有系统文件
参数说明：
-a，所有参数都必须持有真实的文件显示
-p，进程号
-d，txt记录将被过滤掉；^ 排除的意思 (the carat [^] means exclude).
[root@monitor run]# lsof -a -p 4653 -d ^txt //【重要】
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sendmail 4653 root cwd DIR 253,0 4096 9666678 /var/spool/mqueue
sendmail 4653 root rtd DIR 253,0 4096 2 /
sendmail 4653 root mem REG 253,0 6684758 /lib/libdb-4.3.so (path inode=6684892)
sendmail 4653 root DEL REG 253,0 2107155 /usr/lib/liblber-2.3.so.0.2.15.#prelink#.1kBcGu
sendmail 4653 root DEL REG 253,0 2107070 /usr/lib/libgssapi_krb5.so.2.2.#prelink#.Y8RNd8
sendmail 4653 root mem REG 253,0 2101464 /usr/lib/libz.so.1.2.3 (path inode=2117529)
sendmail 4653 root mem REG 253,0 46680 6684713 /lib/libnss_files-2.5.so
sendmail 4653 root mem REG 253,0 14596 2162994 /usr/lib/sasl2/libanonymous.so.2.0.22
sendmail 4653 root mem REG 253,0 905200 2164220 /usr/lib/sasl2/libsasldb.so.2.0.22
sendmail 4653 root mem REG 253,0 6684723 /lib/libresolv-2.5.so (path inode=6686208)
sendmail 4653 root mem REG 253,0 6684701 /lib/libcrypt-2.5.so (path inode=6686216)
sendmail 4653 root mem REG 253,0 6684759 /lib/libkeyutils-1.2.so (path inode=6686207)
sendmail 4653 root 2w CHR 1,3 1449 /dev/null
sendmail 4653 root 3u unix 0xd45eb740 9306 socket
sendmail 4653 root 4u IPv4 9307 TCP monitor:smtp (LISTEN)
sendmail 4653 root 5wW REG 253,0 33 9667079 /var/run/sendmail.pid
6，ls命令参数解释
[root@monitor monitor]# ls –sortk
8 -rw-r--r—1 root 1 Dec 9 16:02 error.txt
120 -rw-r--r—1 root 112 Dec 10 16:38 test
参数说明：
s:第一列显示的块大小（个）；o：类似l 但不显示group； S：按文件大小排序
r：倒序； t：按时间排序 k：字节数按KB来显示
三、参考文档：
http://www.ibm.com/developerworks/aix/library/au-lsof.html
http://www.eygle.com/archives/2009/10/linux_unix_file_handle_deleted.html
http://bkeep.blog.163.com/blog/static/12341429020097155811342/
大量LAST_ACK 分
SecureCRT异常关
