http://www.ibm.com/developerworks/aix/library/au-lsof.html
http://www.lifelinux.com/10-lsof-command-examples/
例子：
bash-3.00# lsof
命令 进程号 用户 设备 大小 inode 文件名
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sched 0 root cwd VDIR 136,8 1024 2 /
init 1 root cwd VDIR 136,8 1024 2 /
init 1 root txt VREG 136,8 49016 1655 /sbin/init
init 1 root txt VREG 136,8 51084 3185 /lib/libuutil.so.1
vi 2013 root 3u VREG 136,8 0 8501 /var/tmp/ExXDaO7d
The FD column represents the file descriptor, which is how the application sees the file.
cwd 表示目录
txt 表示可执行代码
3u 3表示fd的号，u表示可读写状态
The Type column gives more description about what form the file takes.
REG and DIR CHR and BLK
UNIX, FIFO , and IPv4 for UNIX domain sockets, first-in-first-out (FIFO) queues, and Internet Protocol (IP) sockets.
显示指定的某个pid进程打开的文件
-a 表示后面的条件为同事满足， -p制定进程id，-d 用来指定文件的类型，
sh-3.00# lsof -a -p 605 -d ^txt
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sendmail 605 root cwd VDIR 136,8 1024 23554 /var/spool/mqueue
sendmail 605 root 0r VCHR 13,2 6815752 /devices/pseudo/mm@0:null
sendmail 605 root 1w VCHR 13,2 6815752 /devices/pseudo/mm@0:null
sendmail 605 root 2w VCHR 13,2 6815752 /devices/pseudo/mm@0:null
sendmail 605 root 3r DOOR 0t0 58
/var/run/name_service_door(door to nscd[81]) (FA:->0x30002b156c0)
sendmail 605 root 4w VCHR 21,0 11010052
/devices/pseudo/log@0:conslog->LOG
sendmail 605 root 5u IPv4 0x300010ea640 0t0 TCP *:smtp (LISTEN)
sendmail 605 root 6u IPv6 0x3000431c180 0t0 TCP *:smtp (LISTEN)
sendmail 605 root 7u IPv4 0x300046d39c0 0t0 TCP *:submission (LISTEN)
sendmail 605 root 8wW VREG 281,3 32 8778600 /var/run/sendmail.pid
显示谁使用了某个文件
使用-D进行递归
bash-3.00# lsof /var/run/sendmail.pid
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sendmail 605 root 8wW VREG 281,3 32 8778600 /var/run/sendmail.pid
这个也可以用fuser来查
$/sbin/fuser -v .nfs00c3f4690000107a
USER PID ACCESS COMMAND
.nfs00c3f4690000107a wyang2 834 f.... cscope
显示谁在用端口25
# lsof -i :25
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sendmail 605 root 5u IPv4 0x300010ea640 0t0 TCP *:smtp (LISTEN)
sendmail 605 root 6u IPv6 0x3000431c180 0t0 TCP *:smtp (LISTEN)
The lsof utility expects that you will pass it something in the form of protocol:@ip:port,
where the protocol is TCP or UDP (and optionally prefixed by 4 or 6 to refer to the version of IP),
the IP is a resolvable name or IP address, and the port is a number or name (out of /etc/services) representing the service.
显示active的连接
# lsof -i @192.168.1.10
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1934 root 6u IPv6 0x300046d21c0 0t1303608 TCP sun:ssh->linux:40379
(ESTABLISHED)
sshd 1937 root 4u IPv6 0x300046d21c0 0t1303608 TCP sun:ssh->linux:40379
(ESTABLISHED)