其他
每天学一个 Linux 命令（68）：lsof
点击下方“民工哥技术之路”，选择“设为星标”
回复“1024”获取独家整理的学习资料！
命令简介
lsof 命令用于显示 Linux 系统当前已打开的所有文件列表。查看进程或系统打开的文件会给调试带来极大的帮助。下面简单地介绍 lsof 常使用的功能。
lsof （list open files）命令用于查看你进程打开的文件，打开文件的进程，进程打开的端口(TCP、UDP),还可以用于找回/恢复被删除的文件。lsof 命令需要访问核心内存和各种文件，所以需要具备 root 超级管理员权限的用户才能执行此命令。
语法格式
lsof [Options]
选项说明
-a #显示打开文件的进程
-c<进程名> #显示指定进程所打开的文件
-g #显示GID号进程详情
-d<文件号> #显示占用该文件号的进程
+d<目录> #显示目录下被打开的文件
+D<目录> #递归列出目录下被打开的文件
-n<目录> #显示使用NFS的文件
-l #在输出显示用户ID而不是用户名
-i<条件> #输出符合条件的进程
-p<进程号> #输出指定进程号所打开的文件
-u #显示指定UID号进程详情
-h #显示帮助信息
-t #仅获取进程ID
-U #获取UNIX套接口地址
-F #格式化输出结果
-v #显示版本信息
应用举例
显示所有连接
[root@CentOS7-1 ~]# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chronyd 629 chrony 5u IPv4 16952 0t0 UDP localhost:323
chronyd 629 chrony 6u IPv6 16953 0t0 UDP localhost:323
sshd 866 root 3u IPv4 19638 0t0 TCP *:ssh (LISTEN)
sshd 866 root 4u IPv6 19647 0t0 TCP *:ssh (LISTEN)
master 976 root 13u IPv4 20415 0t0 TCP localhost:smtp (LISTEN)
master 976 root 14u IPv6 20416 0t0 TCP localhost:smtp (LISTEN)
netdata 18325 netdata 4u IPv4 114083 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 5u IPv6 114084 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 36u IPv6 114297 0t0 UDP localhost:8125
netdata 18325 netdata 37u IPv4 114298 0t0 UDP localhost:8125
netdata 18325 netdata 38u IPv6 114302 0t0 TCP localhost:8125 (LISTEN)
netdata 18325 netdata 39u IPv4 114303 0t0 TCP localhost:8125 (LISTEN)
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
只显示IPV6的连接信息
[root@CentOS7-1 ~]# lsof -i 6
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chronyd 629 chrony 6u IPv6 16953 0t0 UDP localhost:323
sshd 866 root 4u IPv6 19647 0t0 TCP *:ssh (LISTEN)
master 976 root 14u IPv6 20416 0t0 TCP localhost:smtp (LISTEN)
netdata 18325 netdata 5u IPv6 114084 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 36u IPv6 114297 0t0 UDP localhost:8125
netdata 18325 netdata 38u IPv6 114302 0t0 TCP localhost:8125 (LISTEN)
只显示IPV4的连接信息
[root@CentOS7-1 ~]# lsof -i 4
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chronyd 629 chrony 5u IPv4 16952 0t0 UDP localhost:323
sshd 866 root 3u IPv4 19638 0t0 TCP *:ssh (LISTEN)
master 976 root 13u IPv4 20415 0t0 TCP localhost:smtp (LISTEN)
netdata 18325 netdata 4u IPv4 114083 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 37u IPv4 114298 0t0 UDP localhost:8125
netdata 18325 netdata 39u IPv4 114303 0t0 TCP localhost:8125 (LISTEN)
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
仅显示TCP连接
[root@CentOS7-1 ~]# lsof -i tcp
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 866 root 3u IPv4 19638 0t0 TCP *:ssh (LISTEN)
sshd 866 root 4u IPv6 19647 0t0 TCP *:ssh (LISTEN)
master 976 root 13u IPv4 20415 0t0 TCP localhost:smtp (LISTEN)
master 976 root 14u IPv6 20416 0t0 TCP localhost:smtp (LISTEN)
netdata 18325 netdata 4u IPv4 114083 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 5u IPv6 114084 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 38u IPv6 114302 0t0 TCP localhost:8125 (LISTEN)
netdata 18325 netdata 39u IPv4 114303 0t0 TCP localhost:8125 (LISTEN)
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
仅显示UDP连接
[root@CentOS7-1 ~]# lsof -i udp
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chronyd 629 chrony 5u IPv4 16952 0t0 UDP localhost:323
chronyd 629 chrony 6u IPv6 16953 0t0 UDP localhost:323
netdata 18325 netdata 36u IPv6 114297 0t0 UDP localhost:8125
netdata 18325 netdata 37u IPv4 114298 0t0 UDP localhost:8125
显示指定端口的连接信息
[root@CentOS7-1 ~]# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 866 root 3u IPv4 19638 0t0 TCP *:ssh (LISTEN)
sshd 866 root 4u IPv6 19647 0t0 TCP *:ssh (LISTEN)
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
[root@CentOS7-1 ~]# lsof -i :80
[root@CentOS7-1 ~]# lsof -i :62148
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
列由某个用户打开的进程或文件
[root@CentOS7-1 ~]# lsof -u root | head -5
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,0 262 64 /
systemd 1 root rtd DIR 253,0 262 64 /
systemd 1 root txt REG 253,0 1628608 16959493 /usr/lib/systemd/systemd
systemd 1 root mem REG 253,0 20064 1679454 /usr/lib64/libuuid.so.1.3.0
#列出除了root以外用户打开的文件
[root@CentOS7-1 ~]# lsof -u ^root | head
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
polkitd 618 polkitd cwd DIR 253,0 262 64 /
polkitd 618 polkitd rtd DIR 253,0 262 64 /
polkitd 618 polkitd txt REG 253,0 120432 17108633 /usr/lib/polkit-1/polkitd
polkitd 618 polkitd mem REG 253,0 61560 18290 /usr/lib64/libnss_files-2.17.so
polkitd 618 polkitd mem REG 253,0 68192 40949 /usr/lib64/libbz2.so.1.0.6
polkitd 618 polkitd mem REG 253,0 99952 324334 /usr/lib64/libelf-0.176.so
polkitd 618 polkitd mem REG 253,0 19896 46144 /usr/lib64/libattr.so.1.1.0
polkitd 618 polkitd mem REG 253,0 20064 1679454 /usr/lib64/libuuid.so.1.3.0
polkitd 618 polkitd mem REG 253,0 265576 20649 /usr/lib64/libblkid.so.1.1.0
显示指定的连接信息
#显示指定到指定主机的连接
[root@CentOS7-1 ~]# lsof -i@192.168.1.100
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
#显示指定到指定主机端口的连接
[root@CentOS7-1 ~]# lsof -i@192.168.1.100:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
显示某些状态的端口信息
#找出处于监听状态的端口
[root@CentOS7-1 ~]# lsof -i -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 866 root 3u IPv4 19638 0t0 TCP *:ssh (LISTEN)
sshd 866 root 4u IPv6 19647 0t0 TCP *:ssh (LISTEN)
master 976 root 13u IPv4 20415 0t0 TCP localhost:smtp (LISTEN)
master 976 root 14u IPv6 20416 0t0 TCP localhost:smtp (LISTEN)
netdata 18325 netdata 4u IPv4 114083 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 5u IPv6 114084 0t0 TCP *:dnp-sec (LISTEN)
netdata 18325 netdata 38u IPv6 114302 0t0 TCP localhost:8125 (LISTEN)
netdata 18325 netdata 39u IPv4 114303 0t0 TCP localhost:8125 (LISTEN)
##找出处于已连接状态的端口
[root@CentOS7-1 ~]# lsof -i -sTCP:ESTABLISHED
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 18968 root 3u IPv4 118704 0t0 TCP CentOS7-1:ssh->192.168.1.93:62148 (ESTABLISHED)
终止用户行为
[root@CentOS7-1 ~]# lsof -u mingongge
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 20369 mingongge cwd DIR 253,0 82 462615 /home/mingongge
bash 20369 mingongge rtd DIR 253,0 262 64 /
bash 20369 mingongge txt REG 253,0 964536 50333070 /usr/bin/bash
bash 20369 mingongge mem REG 253,0 106172832 50333042 /usr/lib/locale/locale-archive
bash 20369 mingongge mem REG 253,0 61560 18290 /usr/lib64/libnss_files-2.17.so
bash 20369 mingongge mem REG 253,0 2156240 18266 /usr/lib64/libc-2.17.so
bash 20369 mingongge mem REG 253,0 19248 18273 /usr/lib64/libdl-2.17.so
bash 20369 mingongge mem REG 253,0 174576 20696 /usr/lib64/libtinfo.so.5.9
bash 20369 mingongge mem REG 253,0 163312 1679434 /usr/lib64/ld-2.17.so
bash 20369 mingongge mem REG 253,0 26970 16806930 /usr/lib64/gconv/gconv-modules.cache
bash 20369 mingongge 0u CHR 136,1 0t0 4 /dev/pts/1
bash 20369 mingongge 1u CHR 136,1 0t0 4 /dev/pts/1
bash 20369 mingongge 2u CHR 136,1 0t0 4 /dev/pts/1
bash 20369 mingongge 255u CHR 136,1 0t0 4 /dev/pts/1
vim 20391 mingongge cwd DIR 253,0 82 462615 /home/mingongge
vim 20391 mingongge rtd DIR 253,0 262 64 /
vim 20391 mingongge txt REG 253,0 2337192 51061591 /usr/bin/vim
vim 20391 mingongge mem REG 253,0 61560 18290 /usr/lib64/libnss_files-2.17.so
vim 20391 mingongge mem REG 253,0 106172832 50333042 /usr/lib/locale/locale-archive
vim 20391 mingongge mem REG 253,0 11392 8814 /usr/lib64/libfreebl3.so
vim 20391 mingongge mem REG 253,0 14424 1679441 /usr/lib64/libutil-2.17.so
vim 20391 mingongge mem REG 253,0 40600 18271 /usr/lib64/libcrypt-2.17.so
vim 20391 mingongge mem REG 253,0 115816 18278 /usr/lib64/libnsl-2.17.so
vim 20391 mingongge mem REG 253,0 109976 18302 /usr/lib64/libresolv-2.17.so
vim 20391 mingongge mem REG 253,0 19896 46144 /usr/lib64/libattr.so.1.1.0
vim 20391 mingongge mem REG 253,0 402384 20698 /usr/lib64/libpcre.so.1.2.0
vim 20391 mingongge mem REG 253,0 2156240 18266 /usr/lib64/libc-2.17.so
vim 20391 mingongge mem REG 253,0 142144 18300 /usr/lib64/libpthread-2.17.so
vim 20391 mingongge mem REG 253,0 1647328 282389 /usr/lib64/perl5/CORE/libperl.so
vim 20391 mingongge mem REG 253,0 19248 18273 /usr/lib64/libdl-2.17.so
vim 20391 mingongge mem REG 253,0 27752 669 /usr/lib64/libgpm.so.2.1.0
vim 20391 mingongge mem REG 253,0 37064 18281 /usr/lib64/libacl.so.1.1.0
vim 20391 mingongge mem REG 253,0 174576 20696 /usr/lib64/libtinfo.so.5.9
vim 20391 mingongge mem REG 253,0 155744 1679449 /usr/lib64/libselinux.so.1
vim 20391 mingongge mem REG 253,0 1136944 18275 /usr/lib64/libm-2.17.so
vim 20391 mingongge mem REG 253,0 163312 1679434 /usr/lib64/ld-2.17.so
vim 20391 mingongge 0u CHR 136,1 0t0 4 /dev/pts/1
vim 20391 mingongge 1u CHR 136,1 0t0 4 /dev/pts/1
vim 20391 mingongge 2u CHR 136,1 0t0 4 /dev/pts/1
vim 20391 mingongge 3u REG 253,0 12288 462619 /home/mingongge/.test.sh.swp
然后我们使用下面的命令来终止这个用户的这些操作行为
[root@CentOS7-1 ~]# kill -9 `lsof -t -u mingongge`
[root@CentOS7-1 ~]# lsof -u mingongge
#你会发现这个用户的所有操作都被终止了
这个命令组合，在日常使用环境下还可以用于检查服务器被攻击的行为，如果有行为异常的用户登录操作，可以使用管理员暂时将此用户的一切操作全部干掉，然后再找出解决方法。
再见 FTP/SFTP！下一代文件传输利器 Croc 来了！