Swiss Army Knife of Unix Debugging: lsof

[jf]

Don't forget that you can use lsof to undelete files (provided that at least one process still has the file open): http://www.linux.com/archive/articles/58142

[nailer]

I think your post is actually more useful than the article.

[mattiss]

Excellent! I think I know Unix pretty well, but it would be great if someone had a directory of common use scenarios that one could look through, rather than using Google and wading through horrible forum posts...

[ars]

You don't have to use lsof for that. Just find the pid of the process that has it open, then cd /proc/<pid>/fd and then ls -l

lsof doesn't really do anything for you if you know the pid already. (But it's great if you don't know the pid.)

Then, look through the list for your file, and copy the file descriptor just like in the article.

[PStamatiou]

doesn't seem like that's possible in OS X due to no /proc natively. I'm going to see if I can do it with MacFUSE & procfs..

[yan]

If you feel that lsof is the swiss army knife of unix debugging, then you haven't done much serious unix debugging. Don't get me wrong, lsof is useful and even indispensable in some situations, but not exactly be-all-end-all.

DTrace fits that description much closer, even though its only available for OpenSolaris, OS X, I believe FreBSD has a port and Linux is getting one.

edit: also see: strace, ltrace, gdb, truss

[pkrumins]

Two swiss knives for me then. One in the right pocket, the other in the left. ;)

Gonna write about strace in one of the next articles. And possibly also about dtrace in another article.

[woadwarrior01]

Thats the first thing that came to my mind when I read it as well. DTrace (and strace to a lesser extent) are the first things which come to mind whenever you've got to debug anything or atleast get a clue about whats going on in a runaway process.

[nailer]

You'd use SystemTap for kernel-level tracing and breakpoint debugging on Linux. Check the wiki for a bunch of useful pre-cut tap files.

Linux does indeed have a port of dtrace, but it's not legal due to Sun's license.

[clutchski]

Yeah, the headline is a poor analogy for an otherwise well-written and useful atricle.

[lanstein]

I just sent him 'The Seasoned Schemer'. If anyone wants to send him 'The Reasoned Schemer', I'm sure he'd appreciate it, will be about $30 incl. int'l shipping. I know I really appreciate his posts. http://www.amazon.com/gp/registry/wishlist/QDKYO6OQUU4O?reve...

[silentbicycle]

While you could send him The Reasoned Schemer (I already sold my copy), IMHO _The Art of Prolog_ is a far better book for learning the same material (logic programming, declarative programming, DSLs). Whatever you think about Prolog, it's as deep a book as SICP. Seriously wonderful. (O'Keefe's _The Craft of Prolog_ is a good follow-up.)

It's nice to have a hardbound copy of the newest edition, but the previous edition is available for comparatively cheap (US$6), and torrents of both seem to get around. FYI.

[pkrumins]

Thanks for "The Seasoned Schemer" book! You are absolutely right that I'd also appreciate "The Reasoned Schemer". :)

[pkrumins]

Someone has bought me "The Reasoned Schemer"! :)

I will now have all three books, reasoned, seasoned and little schemer. :)

Huge thanks to the person who bought the reasoned schemer!

Merry Christmas!

[cliff]

Warning: lsof can cause a kernel panic in OSX. I haven't tested it since leopard, but if you loop lsof continuously you'll hit it. There's some kind of race condition.

[spudlyo]

One of the reasons that advanced lsof usage isn't that common is that the Linux man page for it so dense, and a bunch of details you don't need to get started using it are in the first few pages. I've tried a number of times to get all the way through it and have never finished. Thankfully there are some examples at the end.

[sammcd]

I run into this a lot.

Port is in use 8003.

lsof -i :8003

Then I kill whatever process was on 8003. I do this a lot with my Django development if I didn't kill the server right the first time.

[neilk]

As long as everybody is learning about lsof this week, you might also want to check out a similar utility, fuser, which lists which processes are using a particular file.

http://linuxcommand.org/man_pages/fuser1.html

It's really handy for some situations. For instance, if a process can't grab some port, you can use fuser to quickly determine which process grabbed it first.