lsfd is intended to be a modern replacement for lsof(8) on Linux systems. Unlike lsof, lsfd is specialized to Linux kernel; it supports Linux specific features like namespaces with simpler code. lsfd is not a drop-in replacement for lsof; they are different in the command line interface and output formats.
lsfd uses Libsmartcols for output formatting and filtering. See the description of --output option for customizing the output format, and --filter option for filtering.
-l, --threads
-J, --json
-n, --noheadings
-o, --output list
The default list of columns may be extended if list is specified in the format +list (e.g., lsfd -o +DELETED).
-r, --raw
--notruncate
-p, --pid pids
Both -Q option with an expression including PID, e.g. -Q (PID == 1), and -p option, e.g. -p 1, may print the same output but using -p option is much more efficient because -p option works at a much earlier stage of processing than the -Q option.
-Q, --filter expr
-C, --counter label:filter_expr
See FILTER EXPRESSION about filter_expr. label should not include { nor :. You can define multiple counters by specifying this option multiple times.
See also COUNTER EXAMPLES.
--summary[=when]
The summary reports counters. A counter consists of a label and an integer value. --counter is the option for defining a counter. If a user defines no counter, lsfd uses the definitions of pre-defined built-in counters (default counters) to make the summary output.
CAUTION: Using --summary and --json may make the output broken. Only combining --summary=only and --json is valid.
--debug-filter
--dump-counters
-h, --help
-V, --version
Each column has a type. Types are surround by < and >.
CAUTION: The names and types of columns are not stable yet. They may be changed in the future releases.
ASSOC <string>
BLKDRV <string>
CHRDRV <string>
COMMAND <string>
DELETED <boolean>
DEV <string>
DEVTYPE <string>
FD <number>
FLAGS <string>
FUID <number>
INODE <number>
KTHREAD <boolean>
MAJ:MIN <string>
MAPLEN <number>
MISCDEV <string>
MNTID <number>
MODE <string>
NAME <string>
NLINK <number>
OWNER <string>
PARTITION <string>
PID <number>
POS <number>
PROTONAME <string>
RDEV <string>
SIZE <number>
SOURCE <string>
TID <number>
TYPE <string>
UID <number>
USER <string>
lsfd evaluates the expression passed to --filter option every time before printing a file line. lsfd prints the line only if the result of evaluation is true.
An expression consists of column names, literals and, operators like: DELETED, (PID == 1), (NAME == "/etc/passwd"), (PID == 1) && DELETED. DELETED, PID, and NAME are column names in the example. 1 and "/etc/passwd" are literals. == and && are operators.
Before evaluation, lsfd substitutes column names in the given expression with actual column values in the line. There are three different data types: boolean, string, and number. For columns with a boolean type, the value can be stand-alone. For string and number values, the value must be an operand of an operator, for example, (PID == 1). See the "OUTPUT COLUMNS" about the types of columns.
Literal is for representing a value directly. See BOOLLIT, STRLIT, and NUMLIT. Different data types have different literal syntax.
An operator works with one or two operand(s). An operator has an expectation about the data type(s) of its operands. Giving an unexpected data type to an operator causes a syntax error.
Operators taking two operands are and, or, eq, ne, le, lt, ge, gt, =~, !~. Alphabetically named operators have C-language flavored aliases: &&, ||, ==, !=, <, ⇐, >=, and >.
! is the only operator that takes one operand.
eq, ne, and their aliases expect operands have the same data type. Applying these operators return a boolean.
and, or, not and their aliases expect operands have bool data type. Applying these operators return a boolean.
lt, le, gt, ge, and their aliases expect operands have number data types. Applying these operators return a boolean.
=~ is for regular expression matching; if a string at the right side matches a regular expression at the left side, the result is true. The right side operand must be a string literal. See STRLIT about the syntax.
!~ is a short-hand version of not (STR =~ PAT); it inverts the result of =~.
The current implementation does not define precedences within operators. Use ( and ) explicitly for grouping the sub-expressions if your expression uses more than two operators.
About number typed values, the filter engine supports only non-negative integers.
EXPR
BOOLEXP0
BOOLEXP
COLUMN
BOOLOP1
STREXP
NUMEXP
BOOLLIT
CHARS
STRLIT
NUMLIT
BOOLOP2
OP2
BOOLOP2BL
OP2BL
BOOLOP2CMP
OP2CMP
BOOLOP2REG
OP2REG
lsfd has few options for filtering. In most of cases, what you should know is -Q (or --filter) option. Combined with -o (or --output) option, you can customize the output as you want.
List files associated with PID 1 and PID 2 processes:
# lsfd -Q '(PID == 1) or (PID == 2)'
Do the same in an alternative way:
# lsfd -Q '(PID == 1) || (PID == 2)'
Do the same in a more efficient way:
# lsfd --pid 1,2
Whitescapes can be used instead of a comma:
# lsfd --pid '1 2'
Utilize pidof(1) for list the files associated with "firefox":
# lsfd --pid "$(pidof firefox)"
List the 1st file descriptor opened by PID 1 process:
# lsfd -Q '(PID == 1) and (FD == 1)'
Do the same in an alternative way:
# lsfd -Q '(PID == 1) && (FD == 1)'
List all running executables:
# lsfd -Q 'ASSOC == "exe"'
Do the same in an alternative way:
# lsfd -Q 'ASSOC eq "exe"'
Do the same but print only file names:
# lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u
List deleted files associated to processes:
# lsfd -Q 'DELETED'
List non-regular files:
# lsfd -Q 'TYPE != "REG"'
List block devices:
# lsfd -Q 'DEVTYPE == "blk"'
Do the same with TYPE column:
# lsfd -Q 'TYPE == "BLK"'
List files including "dconf" directory in their names:
# lsfd -Q 'NAME =~ ".\*/dconf/.*"'
List files opened in a QEMU virtual machine:
# lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)'
Hide files associated to kernel threads:
# lsfd -Q '!KTHREAD'
Report the numbers of netlink socket descriptors and unix socket descriptors:
# lsfd --summary=only \
-C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
-C 'unix sockets':'(NAME =~ "UNIX:.*")'
VALUE COUNTER
57 netlink sockets
1552 unix sockets
Do the same but print in JSON format:
# lsfd --summary=only --json \
-C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
-C 'unix sockets':'(NAME =~ "UNIX:.*")'
{
"lsfd-summary": [
{
"value": 15,
"counter": "netlink sockets"
},{
"value": 798,
"counter": "unix sockets"
}
]
}
The lsfd command is part of the util-linux package since v2.38.
For bug reports, use the issue tracker at <https://github.com/util-linux/util-linux/issues>.
The lsfd command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.