进程管理
ps
ps 命令用于报告当前系统的进程状态。可以搭配kill 指令随时中断、删除不必要的程序。ps命令是最基本同时也是非常强大的进程查看命令，使用该命令可以确定有哪些进程正在运行和运行的状态、进程是否结束、进程有没有僵死、哪些进程占用了过多的资源等等，大部分信息都是可以通过执行该命令得到的, 所以选项多的离谱！
-a：显示所有终端机下执行的程序，除了阶段作业领导者之外。
a：显示现行终端机下的所有程序，包括其他用户的程序。
-A：显示所有程序。
-c：显示CLS和PRI栏位。
c：列出程序时，显示每个程序真正的指令名称，而不包含路径，选项或常驻服务的标示。
-C<指令名称>：指定执行指令的名称，并列出该指令的程序的状况。
-d：显示所有程序，但不包括阶段作业领导者的程序。
-e：此选项的效果和指定"A"选项相同。
e：列出程序时，显示每个程序所使用的环境变量。
-f：显示UID,PPIP,C与STIME栏位。
f：用ASCII字符显示树状结构，表达程序间的相互关系。
-g<群组名称>：此选项的效果和指定"-G"选项相同，当亦能使用阶段作业领导者的名称来指定。
g：显示现行终端机下的所有程序，包括群组领导者的程序。
-G<群组识别码>：列出属于该群组的程序的状况，也可使用群组名称来指定。
h：不显示标题列。
-H：显示树状结构，表示程序间的相互关系。
-j或j：采用工作控制的格式显示程序状况。
-l或l：采用详细的格式来显示程序状况。
L：列出栏位的相关信息。
-m或m：显示所有的执行绪。
n：以数字来表示USER和WCHAN栏位。
-N：显示所有的程序，除了执行ps指令终端机下的程序之外。
-p<程序识别码>：指定程序识别码，并列出该程序的状况。
p<程序识别码>：此选项的效果和指定"-p"选项相同，只在列表格式方面稍有差异。
r：只列出现行终端机正在执行中的程序。
-s<阶段作业>：指定阶段作业的程序识别码，并列出隶属该阶段作业的程序的状况。
s：采用程序信号的格式显示程序状况。
S：列出程序时，包括已中断的子程序资料。
-t<终端机编号>：指定终端机编号，并列出属于该终端机的程序的状况。
t<终端机编号>：此选项的效果和指定"-t"选项相同，只在列表格式方面稍有差异。
-T：显示现行终端机下的所有程序。
-u<用户识别码>：此选项的效果和指定"-U"选项相同。
u：以用户为主的格式来显示程序状况。
-U<用户识别码>：列出属于该用户的程序的状况，也可使用用户名称来指定。
U<用户名称>：列出属于该用户的程序的状况。
v：采用虚拟内存的格式显示程序状况。
-V或V：显示版本信息。
-w或w：采用宽阔的格式来显示程序状况。
x：显示所有程序，不以终端机来区分。
X：采用旧式的Linux i386登陆格式显示程序状况。
-y：配合选项"-l"使用时，不显示F(flag)栏位，并以RSS栏位取代ADDR栏位 。
-<程序识别码>：此选项的效果和指定"p"选项相同。
--cols<每列字符数>：设置每列的最大字符数。
--columns<每列字符数>：此选项的效果和指定"--cols"选项相同。
--cumulative：此选项的效果和指定"S"选项相同。
--deselect：此选项的效果和指定"-N"选项相同。
--forest：此选项的效果和指定"f"选项相同。
--headers：重复显示标题列。
--help：在线帮助。
--info：显示排错信息。
--lines<显示列数>：设置显示画面的列数。
--no-headers：此选项的效果和指定"h"选项相同，只在列表格式方面稍有差异。
--group<群组名称>：此选项的效果和指定"-G"选项相同。
--Group<群组识别码>：此选项的效果和指定"-G"选项相同。
--pid<程序识别码>：此选项的效果和指定"-p"选项相同。
--rows<显示列数>：此选项的效果和指定"--lines"选项相同。
--sid<阶段作业>：此选项的效果和指定"-s"选项相同。
--tty<终端机编号>：此选项的效果和指定"-t"选项相同。
--user<用户名称>：此选项的效果和指定"-U"选项相同。
--User<用户识别码>：此选项的效果和指定"-U"选项相同。
--version：此选项的效果和指定"-V"选项相同。
--widty<每列字符数>：此选项的效果和指定"-cols"选项相同。
常用选项参数
-A 列出所有的行程
-w 显示加宽可以显示较多的资讯
-au 显示较详细的资讯
-aux 显示所有包含其他使用者的行程
au(x) 输出格式 :
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
USER: 行程拥有者
PID: pid
%CPU: 占用的 CPU 使用率
%MEM: 占用的记忆体使用率
VSZ: 占用的虚拟记忆体大小
RSS: 占用的记忆体大小
TTY: 终端的次要装置号码 (minor device number of tty)
STAT: 该行程的状态:
D: 无法中断的休眠状态 (通常 IO 的进程)
R: 正在执行中
S: 静止状态
T: 暂停执行
Z: 不存在但暂时无法消除
W: 没有足够的记忆体分页可分配
<: 高优先序的行程
N: 低优先序的行程
L: 有记忆体分页分配并锁在记忆体内 (实时系统或捱A I/O)
START: 行程开始时间
TIME: 执行的时间
COMMAND:所执行的指令
查看某进程
[root@localhost ~]# ps -ef | grep sshd
root 5994 1 0 6月10 ? 00:00:00 /usr/sbin/sshd -D
root 6177 5994 0 04:01 ? 00:00:00 sshd: root@notty
root 24213 27110 0 04:18 pts/0 00:00:00 grep --color=auto sshd
root 27101 5994 0 02:50 ? 00:00:27 sshd: root@pts/0,pts/1
[root@localhost ~]# ps -aux | grep sshd
root 5994 0.0 0.1 112756 4356 ? Ss 6月10 0:00 /usr/sbin/sshd -D
root 6177 0.0 0.1 158916 5712 ? Ss 04:01 0:00 sshd: root@notty
root 24385 0.0 0.0 112832 976 pts/0 R+ 04:18 0:00 grep --color=auto sshd
root 27101 0.5 0.1 159188 6076 ? Ss 02:50 0:27 sshd: root@pts/0,pts/1
pgrep
pgrep 命令以名称为依据从运行进程队列中查找进程，并显示查找到的进程id。每一个进程ID以一个十进制数表示，通过一个分割字符串和下一个ID分开，默认的分割字符串是一个新行。对于每个属性选项，用户可以在命令行上指定一个以逗号分割的可能值的集合。
-o：仅显示找到的最小（起始）进程号；
-n：仅显示找到的最大（结束）进程号；
-l：显示进程名称；
-P：指定父进程号；
-g：指定进程组；
-t：指定开启进程的终端；
-u：指定进程的有效用户ID。
[root@localhost ~]# netstat -luntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5994/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 6561/master
tcp6 0 0 :::80 :::* LISTEN 6445/httpd
tcp6 0 0 :::22 :::* LISTEN 5994/sshd
tcp6 0 0 ::1:25 :::* LISTEN 6561/master
udp 0 0 0.0.0.0:68 0.0.0.0:* 5913/dhclient
udp 0 0 0.0.0.0:68 0.0.0.0:* 16229/dhclient
udp 0 0 127.0.0.1:323 0.0.0.0:* 5573/chronyd
udp6 0 0 ::1:323 :::* 5573/chronyd
[root@localhost ~]# pgrep httpd
6445
6446
6447
6448
6449
6450
6484
6486
6487
[root@localhost ~]# pgrep -l httpd
6445 httpd
6446 httpd
6447 httpd
6448 httpd
6449 httpd
6450 httpd
6484 httpd
6486 httpd
6487 httpd
[root@localhost ~]# pgrep -lo httpd
6445 httpd
[root@localhost ~]# pgrep -ln httpd
6487 httpd
kill
kill命令用来终止执行中的程序或工作。kill可将指定的信息送至程序。预设的信息为SIGTERM(15),可将指定程序终止。若仍无法终止该程序，可使用SIGKILL(9)信息尝试强制终止程序。
-a：当处理当前进程时，不限制命令名和进程号的对应关系；
-l <信息编号>：若不加<信息编号>选项，则-l参数会列出全部的信息名称；
-p：指定kill 命令只打印相关进程的进程号，而不发送任何信号；
-s <信息名称或编号>：指定要送出的信息；
-u：指定用户。
列出所有信号名称
[root@localhost ~]# kill -l
1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL 5) SIGTRAP
6) SIGABRT 7) SIGBUS 8) SIGFPE 9) SIGKILL 10) SIGUSR1
11) SIGSEGV 12) SIGUSR2 13) SIGPIPE 14) SIGALRM 15) SIGTERM
16) SIGSTKFLT 17) SIGCHLD 18) SIGCONT 19) SIGSTOP 20) SIGTSTP
21) SIGTTIN 22) SIGTTOU 23) SIGURG 24) SIGXCPU 25) SIGXFSZ
26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 29) SIGIO 30) SIGPWR
31) SIGSYS 34) SIGRTMIN 35) SIGRTMIN+1 36) SIGRTMIN+2 37) SIGRTMIN+3
38) SIGRTMIN+4 39) SIGRTMIN+5 40) SIGRTMIN+6 41) SIGRTMIN+7 42) SIGRTMIN+8
43) SIGRTMIN+9 44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12 47) SIGRTMIN+13
48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14 51) SIGRTMAX-13 52) SIGRTMAX-12
53) SIGRTMAX-11 54) SIGRTMAX-10 55) SIGRTMAX-9 56) SIGRTMAX-8 57) SIGRTMAX-7
58) SIGRTMAX-6 59) SIGRTMAX-5 60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2
63) SIGRTMAX-1 64) SIGRTMAX
只有第9种信号(SIGKILL)才可以无条件终止进程，其他信号进程都有权利忽略, 下面是常用的信号
HUP 1 终端断线
INT 2 中断（同 Ctrl + C）
QUIT 3 退出（同 Ctrl + \）
TERM 15 终止
KILL 9 强制终止
CONT 18 继续（与STOP相反， fg/bg命令）
STOP 19 暂停（同 Ctrl + Z）
先用ps查找进程，然后用kill杀掉
[root@localhost ~]# ps -aux | grep top
root 25899 0.0 0.0 112828 980 pts/0 R+ 04:20 0:00 grep --color=auto top
root 27215 0.3 0.0 162748 2920 pts/1 S+ 02:50 0:19 top
[root@localhost ~]# kill -9 27215
[root@localhost ~]# ps -aux | grep top
root 26043 0.0 0.0 112828 980 pts/0 R+ 04:20 0:00 grep --color=auto top
pkill
pkill命令可以按照进程名杀死进程。pkill和killall 应用方法差不多，也是直接杀死运行中的程序；如果你想杀掉单个进程，请用kill来杀掉。
-o：仅向找到的最小（起始）进程号发送信号；
-n：仅向找到的最大（结束）进程号发送信号；
-P：指定父进程号发送信号；
-g：指定进程组；
-t：指定开启进程的终端。
[root@localhost ~]# pgrep -l httpd
6445 httpd
6446 httpd
6447 httpd
6448 httpd
6449 httpd
6450 httpd
6484 httpd
6486 httpd
6487 httpd
[root@localhost ~]# pkill httpd
[root@localhost ~]# pgrep -l httpd
killall
需要安装 yum -y install psmisc
killall命令使用进程的名称来杀死进程，使用此指令可以杀死一组同名进程。我们可以使用kill 命令杀死指定进程PID的进程，如果要找到我们需要杀死的进程，我们还需要在之前使用ps 等命令再配合grep 来查找进程，而killall把这两个过程合二为一，是一个很好用的命令。
-e：对长名称进行精确匹配；
-l：忽略大小写的不同；
-p：杀死进程所属的进程组；
-i：交互式杀死进程，杀死进程前需要进行确认；
-l：打印所有已知信号列表；
-q：如果没有进程被杀死。则不输出任何信息；
-r：使用正规表达式匹配要杀死的进程名称；
-s：用指定的进程号代替默认信号“SIGTERM”；
-u：杀死指定用户的进程。
杀死所有同名进程
killall httpd
pidof
pidof 命令用于查找指定名称的进程的进程号id号。
-s：仅返回一个进程号；
-c：仅显示具有相同“root”目录的进程；
-x：显示由脚本开启的进程；
-o：指定不显示的进程ID。
查找指定进程的进程ID号
[root@localhost ~]# pidof httpd
4394 4393 4392 4391 4390 4389
losf
需要安装 yum -y install lsof
lsof 命令用于查看你进程开打的文件，打开文件的进程，进程打开的端口(TCP、UDP)。找回/恢复删除的文件。是十分方便的系统监视工具，因为lsof命令需要访问核心内存和各种文件，所以需要root用户执行。
-a：列出打开文件存在的进程；
-c<进程名>：列出指定进程所打开的文件；
-g：列出GID号进程详情；
-d<文件号>：列出占用该文件号的进程；
+d<目录>：列出目录下被打开的文件；
+D<目录>：递归列出目录下被打开的文件；
-n<目录>：列出使用NFS的文件；
-i<条件>：列出符合条件的进程。（4、6、协议、:端口、 @ip ）
-p<进程号>：列出指定进程号所打开的文件；
-u：列出UID号进程详情；
-h：显示帮助信息；
-v：显示版本信息。
COMMAND：进程的名称
PID：进程标识符
PPID：父进程标识符（需要指定-R参数）
USER：进程所有者
PGID：进程所属组
FD：文件描述符，应用程序通过文件描述符识别该文件。
DIR：表示目录。
CHR：表示字符类型。
BLK：块设备类型。
UNIX： UNIX 域套接字。
FIFO：先进先出 (FIFO) 队列。
IPv4：网际协议 (IP) 套接字。
DEVICE：指定磁盘的名称
SIZE：文件的大小
NODE：索引节点（文件在磁盘上的标识）
NAME：打开文件的确切名称
列出所有打开的文件
[root@localhost ~]# lsof
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,0 224 64 /
systemd 1 root rtd DIR 253,0 224 64 /
systemd 1 root txt REG 253,0 1616360 28617 /usr/lib/systemd/systemd
systemd 1 root mem REG 253,0 20112 33565434 /usr/lib64/libuuid.so.1.3.0
systemd 1 root mem REG 253,0 265624 33565438 /usr/lib64/libblkid.so.1.1.0
systemd 1 root mem REG 253,0 90248 33562302 /usr/lib64/libz.so.1.2.7
systemd 1 root mem REG 253,0 157424 33565432 /usr/lib64/liblzma.so.5.2.2
systemd 1 root mem REG 253,0 23968 33565460 /usr/lib64/libcap-ng.so.0.0.0
systemd 1 root mem REG 253,0 19896 33565264 /usr/lib64/libattr.so.1.1.0
systemd 1 root DEL REG 253,0 33561978 /usr/lib64/libdl-2.17.so;5ee07b35
systemd 1 root mem REG 253,0 402384 33565277 /usr/lib64/libpcre.so.1.2.0
systemd 1 root DEL REG 253,0 33561972 /usr/lib64/libc-2.17.so;5ee07b35
systemd 1 root DEL REG 253,0 33561998 /usr/lib64/libpthread-2.17.so;5ee07b35
systemd 1 root DEL REG 253,0 33554508 /usr/lib64/libgcc_s-4.8.5-20150702.so.1;5ee07b35
...
查看哪个程序在使用某个文件
[root@localhost ~]# lsof /var/log/httpd/access_log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 14493 root 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14494 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14495 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14496 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14497 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14498 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
递归查看某个目录的文件信息
[root@localhost ~]# lsof | grep /var/log/httpd
httpd 14493 root 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14493 root 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14494 apache 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14494 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14495 apache 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14495 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14496 apache 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14496 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14497 apache 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14497 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
httpd 14498 apache 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14498 apache 7w REG 253,0 18778 442010 /var/log/httpd/access_log
列出某个用户打开的文件信息
[root@localhost ~]# lsof -u root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,0 224 64 /
systemd 1 root rtd DIR 253,0 224 64 /
systemd 1 root txt REG 253,0 1616360 28617 /usr/lib/systemd/systemd
systemd 1 root mem REG 253,0 20112 33565434 /usr/lib64/libuuid.so.1.3.0
systemd 1 root mem REG 253,0 265624 33565438 /usr/lib64/libblkid.so.1.1.0
systemd 1 root mem REG 253,0 90248 33562302 /usr/lib64/libz.so.1.2.7
systemd 1 root mem REG 253,0 157424 33565432 /usr/lib64/liblzma.so.5.2.2
systemd 1 root mem REG 253,0 23968 33565460 /usr/lib64/libcap-ng.so.0.0.0
systemd 1 root mem REG 253,0 19896 33565264 /usr/lib64/libattr.so.1.1.0
systemd 1 root DEL REG 253,0 33561978 /usr/lib64/libdl-2.17.so;5ee07b35
systemd 1 root mem REG 253,0 402384 33565277 /usr/lib64/libpcre.so.1.2.0
systemd 1 root DEL REG 253,0 33561972 /usr/lib64/libc-2.17.so;5ee07b35
systemd 1 root DEL REG 253,0 33561998 /usr/lib64/libpthread-2.17.so;5ee07b35
systemd 1 root DEL REG 253,0 33554508 /usr/lib64/libgcc_s-4.8.5-20150702.so.1;5ee07b35
systemd 1 root DEL REG 253,0 33562002 /usr/lib64/librt-2.17.so;5ee07b35
systemd 1 root mem REG 253,0 277824 33600796 /usr/lib64/libmount.so.1.1.0
systemd 1 root mem REG 253,0 91848 33601989 /usr/lib64/libkmod.so.2.2.10
systemd 1 root DEL REG 253,0 33565464 /usr/lib64/libaudit.so.1.0.0;5ee07fef
...
列出某个程序打开的文件信息
[root@localhost ~]# lsof -c python
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
python 23986 root cwd DIR 253,0 177 100663361 /root
python 23986 root rtd DIR 253,0 224 64 /
python 23986 root txt REG 253,0 7216 27102 /usr/bin/python2.7
python 23986 root mem REG 253,0 106176928 67163655 /usr/lib/locale/locale-archive
python 23986 root mem REG 253,0 2156240 33555827 /usr/lib64/libc-2.17.so
python 23986 root mem REG 253,0 1136944 33555835 /usr/lib64/libm-2.17.so
python 23986 root mem REG 253,0 14424 33555861 /usr/lib64/libutil-2.17.so
python 23986 root mem REG 253,0 19248 33555833 /usr/lib64/libdl-2.17.so
python 23986 root mem REG 253,0 142144 33555853 /usr/lib64/libpthread-2.17.so
python 23986 root mem REG 253,0 1847496 33601094 /usr/lib64/libpython2.7.so.1.0
python 23986 root mem REG 253,0 163312 33554509 /usr/lib64/ld-2.17.so
python 23986 root 0u CHR 136,0 0t0 3 /dev/pts/0
python 23986 root 1u CHR 136,0 0t0 3 /dev/pts/0
python 23986 root 2u CHR 136,0 0t0 3 /dev/pts/0
列出多个文件打开的文件信息
[root@localhost ~]# lsof -c python -c firewalld
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
python 23986 root cwd DIR 253,0 177 100663361 /root
python 23986 root rtd DIR 253,0 224 64 /
python 23986 root txt REG 253,0 7216 27102 /usr/bin/python2.7
python 23986 root mem REG 253,0 106176928 67163655 /usr/lib/locale/locale-archive
python 23986 root mem REG 253,0 2156240 33555827 /usr/lib64/libc-2.17.so
python 23986 root mem REG 253,0 1136944 33555835 /usr/lib64/libm-2.17.so
python 23986 root mem REG 253,0 14424 33555861 /usr/lib64/libutil-2.17.so
python 23986 root mem REG 253,0 19248 33555833 /usr/lib64/libdl-2.17.so
python 23986 root mem REG 253,0 142144 33555853 /usr/lib64/libpthread-2.17.so
python 23986 root mem REG 253,0 1847496 33601094 /usr/lib64/libpython2.7.so.1.0
python 23986 root mem REG 253,0 163312 33554509 /usr/lib64/ld-2.17.so
python 23986 root 0u CHR 136,0 0t0 3 /dev/pts/0
python 23986 root 1u CHR 136,0 0t0 3 /dev/pts/0
python 23986 root 2u CHR 136,0 0t0 3 /dev/pts/0
firewalld 26537 root cwd DIR 253,0 224 64 /
firewalld 26537 root rtd DIR 253,0 224 64 /
firewalld 26537 root txt REG 253,0 7216 27102 /usr/bin/python2.7
firewalld 26537 root mem REG 253,0 262808 100774783 /usr/lib64/girepository-1.0/NM-1.0.typelib
firewalld 26537 root mem REG 253,0 343452 100773776 /usr/lib64/girepository-1.0/Gio-2.0.typelib
firewalld 26537 root mem REG 253,0 12408 100773538 /usr/lib64/python2.7/lib-dynload/grpmodule.so
firewalld 26537 root mem REG 253,0 168312 33658786 /usr/lib64/libdbus-glib-1.so.2.2.2
firewalld 26537 root mem REG 253,0 11976 65382 /usr/lib64/python2.7/site-packages/_dbus_glib_bindings.so
firewalld 26537 root mem REG 253,0 185712 100773773 /usr/lib64/girepository-1.0/GLib-2.0.typelib
firewalld 26537 root mem REG 253,0 20112 33565434 /usr/lib64/libuuid.so.1.3.0
firewalld 26537 root mem REG 253,0 265624 33565438 /usr/lib64/libblkid.so.1.1.0
firewalld 26537 root mem REG 253,0 277824 33600796 /usr/lib64/libmount.so.1.1.0
firewalld 26537 root mem REG 253,0 1722848 33600799 /usr/lib64/libgio-2.0.so.0.5600.1
firewalld 26537 root mem REG 253,0 15688 33600803 /usr/lib64/libgmodule-2.0.so.0.5600.1
firewalld 26537 root mem REG 253,0 32304 33565262 /usr/lib64/libffi.so.6.0.1
firewalld 26537 root mem REG 253,0 1156600 33600801 /usr/lib64/libglib-2.0.so.0.5600.1
firewalld 26537 root mem REG 253,0 335032 33600805 /usr/lib64/libgobject-2.0.so.0.5600.1
firewalld 26537 root mem REG 253,0 217144 33601914 /usr/lib64/libgirepository-1.0.so.1.0.0
firewalld 26537 root mem REG 253,0 7016 33600807 /usr/lib64/libgthread-2.0.so.0.5600.1
firewalld 26537 root mem REG 253,0 331480 33601919 /usr/lib64/python2.7/site-packages/gi/_gi.so
firewalld 26537 root mem REG 253,0 29264 100773551 /usr/lib64/python2.7/lib-dynload/selectmodule.so
firewalld 26537 root mem REG 253,0 11672 100773554 /usr/lib64/python2.7/lib-dynload/syslog.so
firewalld 26537 root mem REG 253,0 19264 100773535 /usr/lib64/python2.7/lib-dynload/fcntlmodule.so
firewalld 26537 root mem REG 253,0 16432 100773520 /usr/lib64/python2.7/lib-dynload/_randommodule.so
firewalld 26537 root mem REG 253,0 22880 100773511 /usr/lib64/python2.7/lib-dynload/_hashlib.so
firewalld 26537 root mem REG 253,0 25768 100773527 /usr/lib64/python2.7/lib-dynload/binascii.so
firewalld 26537 root mem REG 253,0 37376 100773542 /usr/lib64/python2.7/lib-dynload/math.so
firewalld 26537 root mem REG 253,0 156960 100773514 /usr/lib64/python2.7/lib-dynload/_io.so
firewalld 26537 root mem REG 253,0 15688 33565302 /usr/lib64/libkeyutils.so.1.5
firewalld 26537 root mem REG 253,0 62888 33565429 /usr/lib64/libkrb5support.so.0.1
firewalld 26537 root mem REG 253,0 112280 33565421 /usr/lib64/libk5crypto.so.3.1
firewalld 26537 root mem REG 253,0 15920 33562312 /usr/lib64/libcom_err.so.2.1
firewalld 26537 root mem REG 253,0 967728 33565427 /usr/lib64/libkrb5.so.3.3
firewalld 26537 root mem REG 253,0 320392 33565417 /usr/lib64/libgssapi_krb5.so.2.2
firewalld 26537 root mem REG 253,0 2513000 33565406 /usr/lib64/libcrypto.so.1.0.2k
firewalld 26537 root mem REG 253,0 470360 33565408 /usr/lib64/libssl.so.1.0.2k
firewalld 26537 root mem REG 253,0 95120 100773523 /usr/lib64/python2.7/lib-dynload/_ssl.so
firewalld 26537 root mem REG 253,0 83960 100773521 /usr/lib64/python2.7/lib-dynload/_socketmodule.so
firewalld 26537 root mem REG 253,0 39024 100773524 /usr/lib64/python2.7/lib-dynload/_struct.so
firewalld 26537 root mem REG 253,0 21344 100773516 /usr/lib64/python2.7/lib-dynload/_localemodule.so
firewalld 26537 root mem REG 253,0 17056 100773510 /usr/lib64/python2.7/lib-dynload/_functoolsmodule.so
firewalld 26537 root mem REG 253,0 28736 100773553 /usr/lib64/python2.7/lib-dynload/stropmodule.so
firewalld 26537 root mem REG 253,0 173320 33600743 /usr/lib64/libexpat.so.1.6.0
firewalld 26537 root mem REG 253,0 54544 100773548 /usr/lib64/python2.7/lib-dynload/pyexpat.so
firewalld 26537 root mem REG 253,0 22920 100773512 /usr/lib64/python2.7/lib-dynload/_heapq.so
firewalld 26537 root mem REG 253,0 62096 100773540 /usr/lib64/python2.7/lib-dynload/itertoolsmodule.so
firewalld 26537 root mem REG 253,0 47672 100773545 /usr/lib64/python2.7/lib-dynload/operator.so
firewalld 26537 root mem REG 253,0 33096 100773503 /usr/lib64/python2.7/lib-dynload/_collectionsmodule.so
firewalld 26537 root mem REG 253,0 23992 100773530 /usr/lib64/python2.7/lib-dynload/cStringIO.so
firewalld 26537 root mem REG 253,0 25064 100773556 /usr/lib64/python2.7/lib-dynload/timemodule.so
firewalld 26537 root mem REG 253,0 68192 33565440 /usr/lib64/libbz2.so.1.0.6
firewalld 26537 root mem REG 253,0 90248 33562302 /usr/lib64/libz.so.1.2.7
firewalld 26537 root mem REG 253,0 100008 33565453 /usr/lib64/libelf-0.172.so
firewalld 26537 root mem REG 253,0 402384 33565277 /usr/lib64/libpcre.so.1.2.0
firewalld 26537 root mem REG 253,0 19896 33565264 /usr/lib64/libattr.so.1.1.0
firewalld 26537 root mem REG 253,0 88776 33554592 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
firewalld 26537 root mem REG 253,0 330464 33602752 /usr/lib64/libdw-0.172.so
firewalld 26537 root mem REG 253,0 109976 33555855 /usr/lib64/libresolv-2.17.so
firewalld 26537 root mem REG 253,0 19384 33565458 /usr/lib64/libgpg-error.so.0.10.0
firewalld 26537 root mem REG 253,0 535064 33565469 /usr/lib64/libgcrypt.so.11.8.2
firewalld 26537 root mem REG 253,0 85952 33601082 /usr/lib64/liblz4.so.1.7.5
firewalld 26537 root mem REG 253,0 157424 33565432 /usr/lib64/liblzma.so.5.2.2
firewalld 26537 root mem REG 253,0 155784 33565293 /usr/lib64/libselinux.so.1
firewalld 26537 root mem REG 253,0 43712 33555857 /usr/lib64/librt-2.17.so
firewalld 26537 root mem REG 253,0 20032 33565268 /usr/lib64/libcap.so.2.22
firewalld 26537 root mem REG 253,0 203800 33602765 /usr/lib64/libsystemd.so.0.6.0
firewalld 26537 root mem REG 253,0 333384 33602769 /usr/lib64/libdbus-1.so.3.14.14
firewalld 26537 root mem REG 253,0 166248 65381 /usr/lib64/python2.7/site-packages/_dbus_bindings.so
firewalld 26537 root mem REG 253,0 106176928 67163655 /usr/lib/locale/locale-archive
firewalld 26537 root mem REG 253,0 61560 33555845 /usr/lib64/libnss_files-2.17.so
firewalld 26537 root mem REG 253,0 2156240 33555827 /usr/lib64/libc-2.17.so
firewalld 26537 root mem REG 253,0 1136944 33555835 /usr/lib64/libm-2.17.so
firewalld 26537 root mem REG 253,0 14424 33555861 /usr/lib64/libutil-2.17.so
firewalld 26537 root mem REG 253,0 19248 33555833 /usr/lib64/libdl-2.17.so
firewalld 26537 root mem REG 253,0 142144 33555853 /usr/lib64/libpthread-2.17.so
firewalld 26537 root mem REG 253,0 1847496 33601094 /usr/lib64/libpython2.7.so.1.0
firewalld 26537 root mem REG 253,0 163312 33554509 /usr/lib64/ld-2.17.so
firewalld 26537 root mem REG 253,0 59120 100773775 /usr/lib64/girepository-1.0/GObject-2.0.typelib
firewalld 26537 root 0r CHR 1,3 0t0 5334 /dev/null
firewalld 26537 root 1w CHR 1,3 0t0 5334 /dev/null
firewalld 26537 root 2w CHR 1,3 0t0 5334 /dev/null
firewalld 26537 root 3w REG 253,0 5646 100666080 /var/log/firewalld
firewalld 26537 root 4u unix 0xffff96121130c000 0t0 1065928 socket
firewalld 26537 root 5u a_inode 0,10 0 5330 [eventfd]
firewalld 26537 root 6r FIFO 0,9 0t0 1066641 pipe
firewalld 26537 root 7r CHR 1,9 0t0 5339 /dev/urandom
firewalld 26537 root 8w FIFO 0,9 0t0 1066641 pipe
firewalld 26537 root 9r FIFO 0,9 0t0 1066642 pipe
firewalld 26537 root 10w FIFO 0,9 0t0 1066642 pipe
firewalld 26537 root 11r FIFO 0,9 0t0 1066643 pipe
列出除某用户外的被打开的文件
[root@localhost ~]# lsof -u ^root
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
pickup 2233 postfix cwd DIR 253,0 201 67703230 /var/spool/postfix
pickup 2233 postfix rtd DIR 253,0 224 64 /
pickup 2233 postfix txt REG 253,0 285208 67637625 /usr/libexec/postfix/pickup
pickup 2233 postfix mem REG 253,0 61560 33555845 /usr/lib64/libnss_files-2.17.so
pickup 2233 postfix mem REG 253,0 155784 33565293 /usr/lib64/libselinux.so.1
pickup 2233 postfix mem REG 253,0 15688 33565302 /usr/lib64/libkeyutils.so.1.5
pickup 2233 postfix mem REG 253,0 11448 33561681 /usr/lib64/libfreebl3.so
pickup 2233 postfix mem REG 253,0 88776 33554592 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
pickup 2233 postfix mem REG 253,0 43712 33555857 /usr/lib64/librt-2.17.so
pickup 2233 postfix mem REG 253,0 62888 33565429 /usr/lib64/libkrb5support.so.0.1
pickup 2233 postfix mem REG 253,0 15920 33562312 /usr/lib64/libcom_err.so.2.1
pickup 2233 postfix mem REG 253,0 112280 33565421 /usr/lib64/libk5crypto.so.3.1
pickup 2233 postfix mem REG 253,0 967728 33565427 /usr/lib64/libkrb5.so.3.3
pickup 2233 postfix mem REG 253,0 320392 33565417 /usr/lib64/libgssapi_krb5.so.2.2
pickup 2233 postfix mem REG 253,0 40600 33555831 /usr/lib64/libcrypt-2.17.so
pickup 2233 postfix mem REG 253,0 991616 33562316 /usr/lib64/libstdc++.so.6.0.19
pickup 2233 postfix mem REG 253,0 90248 33562302 /usr/lib64/libz.so.1.2.7
pickup 2233 postfix mem REG 253,0 19248 33555833 /usr/lib64/libdl-2.17.so
pickup 2233 postfix mem REG 253,0 142144 33555853 /usr/lib64/libpthread-2.17.so
pickup 2233 postfix mem REG 253,0 251832 33562307 /usr/lib64/libnspr4.so
pickup 2233 postfix mem REG 253,0 20096 33562308 /usr/lib64/libplc4.so
pickup 2233 postfix mem REG 253,0 15800 33562309 /usr/lib64/libplds4.so
pickup 2233 postfix mem REG 253,0 194944 33562310 /usr/lib64/libnssutil3.so
pickup 2233 postfix mem REG 253,0 1249536 33600845 /usr/lib64/libnss3.so
pickup 2233 postfix mem REG 253,0 164288 33600846 /usr/lib64/libsmime3.so
pickup 2233 postfix mem REG 253,0 340976 33600847 /usr/lib64/libssl3.so
pickup 2233 postfix mem REG 253,0 2156240 33555827 /usr/lib64/libc-2.17.so
pickup 2233 postfix mem REG 253,0 109976 33555855 /usr/lib64/libresolv-2.17.so
pickup 2233 postfix mem REG 253,0 115816 33555837 /usr/lib64/libnsl-2.17.so
pickup 2233 postfix mem REG 253,0 1850464 33565441 /usr/lib64/libdb-5.3.so
pickup 2233 postfix mem REG 253,0 2513000 33565406 /usr/lib64/libcrypto.so.1.0.2k
pickup 2233 postfix mem REG 253,0 470360 33565408 /usr/lib64/libssl.so.1.0.2k
pickup 2233 postfix mem REG 253,0 121320 33601002 /usr/lib64/libsasl2.so.3.0.0
pickup 2233 postfix mem REG 253,0 1136944 33555835 /usr/lib64/libm-2.17.so
pickup 2233 postfix mem REG 253,0 3135712 100773845 /usr/lib64/mysql/libmysqlclient.so.18.0.0
pickup 2233 postfix mem REG 253,0 402384 33565277 /usr/lib64/libpcre.so.1.2.0
pickup 2233 postfix mem REG 253,0 61952 33602101 /usr/lib64/liblber-2.4.so.2.10.7
pickup 2233 postfix mem REG 253,0 352624 33602103 /usr/lib64/libldap-2.4.so.2.10.7
pickup 2233 postfix mem REG 253,0 163312 33554509 /usr/lib64/ld-2.17.so
pickup 2233 postfix 0u CHR 1,3 0t0 5334 /dev/null
pickup 2233 postfix 1u CHR 1,3 0t0 5334 /dev/null
pickup 2233 postfix 2u CHR 1,3 0t0 5334 /dev/null
pickup 2233 postfix 3r FIFO 0,9 0t0 34602 pipe
pickup 2233 postfix 4w FIFO 0,9 0t0 34602 pipe
pickup 2233 postfix 5u unix 0xffff9612b6be0c00 0t0 34532 socket
pickup 2233 postfix 6u unix 0xffff961235dfa000 0t0 34529 public/pickup
pickup 2233 postfix 7u unix 0xffff961239560800 0t0 976385 socket
pickup 2233 postfix 8u a_inode 0,10 0 5330 [eventpoll]
列出某一个进程PID所打开的文件
[root@localhost ~]# lsof -p 14493
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 14493 root cwd DIR 253,0 224 64 /
httpd 14493 root rtd DIR 253,0 224 64 /
httpd 14493 root txt REG 253,0 523608 33597695 /usr/sbin/httpd
httpd 14493 root mem REG 253,0 61560 33555845 /usr/lib64/libnss_files-2.17.so
httpd 14493 root mem REG 253,0 27720 100993461 /usr/lib64/httpd/modules/mod_cgi.so
httpd 14493 root mem REG 253,0 68192 33565440 /usr/lib64/libbz2.so.1.0.6
httpd 14493 root mem REG 253,0 157424 33565432 /usr/lib64/liblzma.so.5.2.2
httpd 14493 root mem REG 253,0 100008 33565453 /usr/lib64/libelf-0.172.so
httpd 14493 root mem REG 253,0 19896 33565264 /usr/lib64/libattr.so.1.1.0
httpd 14493 root mem REG 253,0 88776 33554592 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
httpd 14493 root mem REG 253,0 330464 33602752 /usr/lib64/libdw-0.172.so
httpd 14493 root mem REG 253,0 20032 33565268 /usr/lib64/libcap.so.2.22
httpd 14493 root mem REG 253,0 43712 33555857 /usr/lib64/librt-2.17.so
httpd 14493 root mem REG 253,0 28128 33602757 /usr/lib64/libsystemd-daemon.so.0.0.12
httpd 14493 root mem REG 253,0 11128 100664212 /usr/lib64/httpd/modules/mod_systemd.so
httpd 14493 root mem REG 253,0 19360 100664194 /usr/lib64/httpd/modules/mod_proxy_wstunnel.so
httpd 14493 root mem REG 253,0 19464 100664193 /usr/lib64/httpd/modules/mod_proxy_scgi.so
httpd 14493 root mem REG 253,0 39960 100664192 /usr/lib64/httpd/modules/mod_proxy_http.so
httpd 14493 root mem REG 253,0 44192 100664191 /usr/lib64/httpd/modules/mod_proxy_ftp.so
httpd 14493 root mem REG 253,0 11160 100664190 /usr/lib64/httpd/modules/mod_proxy_fdpass.so
httpd 14493 root mem REG 253,0 19384 100664189 /usr/lib64/httpd/modules/mod_proxy_fcgi.so
httpd 14493 root mem REG 253,0 15296 100664188 /usr/lib64/httpd/modules/mod_proxy_express.so
httpd 14493 root mem REG 253,0 19400 100664187 /usr/lib64/httpd/modules/mod_proxy_connect.so
httpd 14493 root mem REG 253,0 48176 100664186 /usr/lib64/httpd/modules/mod_proxy_balancer.so
httpd 14493 root mem REG 253,0 52440 100664185 /usr/lib64/httpd/modules/mod_proxy_ajp.so
httpd 14493 root mem REG 253,0 15328 100664171 /usr/lib64/httpd/modules/mod_lbmethod_heartbeat.so
httpd 14493 root mem REG 253,0 11128 100664170 /usr/lib64/httpd/modules/mod_lbmethod_bytraffic.so
httpd 14493 root mem REG 253,0 11136 100664169 /usr/lib64/httpd/modules/mod_lbmethod_byrequests.so
httpd 14493 root mem REG 253,0 11136 100664168 /usr/lib64/httpd/modules/mod_lbmethod_bybusyness.so
httpd 14493 root mem REG 253,0 118848 100664184 /usr/lib64/httpd/modules/mod_proxy.so
httpd 14493 root mem REG 253,0 31880 100664181 /usr/lib64/httpd/modules/mod_mpm_prefork.so
httpd 14493 root mem REG 253,0 1136944 33555835 /usr/lib64/libm-2.17.so
httpd 14493 root mem REG 253,0 193864 33600744 /usr/lib64/liblua-5.1.so
httpd 14493 root mem REG 253,0 117120 100664176 /usr/lib64/httpd/modules/mod_lua.so
httpd 14493 root mem REG 253,0 19648 100993467 /usr/lib64/httpd/modules/mod_dav_lock.so
httpd 14493 root mem REG 253,0 57120 100993466 /usr/lib64/httpd/modules/mod_dav_fs.so
httpd 14493 root mem REG 253,0 102440 100993465 /usr/lib64/httpd/modules/mod_dav.so
httpd 14493 root mem REG 253,0 11192 100664218 /usr/lib64/httpd/modules/mod_vhost_alias.so
httpd 14493 root mem REG 253,0 11112 100664217 /usr/lib64/httpd/modules/mod_version.so
httpd 14493 root mem REG 253,0 11176 100664215 /usr/lib64/httpd/modules/mod_userdir.so
httpd 14493 root mem REG 253,0 15312 100664214 /usr/lib64/httpd/modules/mod_unixd.so
httpd 14493 root mem REG 253,0 11152 100664213 /usr/lib64/httpd/modules/mod_unique_id.so
httpd 14493 root mem REG 253,0 11176 100664211 /usr/lib64/httpd/modules/mod_suexec.so
httpd 14493 root mem REG 253,0 15288 100664210 /usr/lib64/httpd/modules/mod_substitute.so
httpd 14493 root mem REG 253,0 23472 100664209 /usr/lib64/httpd/modules/mod_status.so
httpd 14493 root mem REG 253,0 23576 100664207 /usr/lib64/httpd/modules/mod_socache_shmcb.so
httpd 14493 root mem REG 253,0 11200 100664206 /usr/lib64/httpd/modules/mod_socache_memcache.so
httpd 14493 root mem REG 253,0 15328 100664205 /usr/lib64/httpd/modules/mod_socache_dbm.so
httpd 14493 root mem REG 253,0 15408 100664204 /usr/lib64/httpd/modules/mod_slotmem_shm.so
httpd 14493 root mem REG 253,0 11248 100664203 /usr/lib64/httpd/modules/mod_slotmem_plain.so
httpd 14493 root mem REG 253,0 15336 100664202 /usr/lib64/httpd/modules/mod_setenvif.so
httpd 14493 root mem REG 253,0 69056 100664200 /usr/lib64/httpd/modules/mod_rewrite.so
httpd 14493 root mem REG 253,0 15328 100664198 /usr/lib64/httpd/modules/mod_reqtimeout.so
httpd 14493 root mem REG 253,0 15312 100664197 /usr/lib64/httpd/modules/mod_remoteip.so
httpd 14493 root mem REG 253,0 36008 100664183 /usr/lib64/httpd/modules/mod_negotiation.so
httpd 14493 root mem REG 253,0 19528 100664178 /usr/lib64/httpd/modules/mod_mime.so
httpd 14493 root mem REG 253,0 27752 100664179 /usr/lib64/httpd/modules/mod_mime_magic.so
httpd 14493 root mem REG 253,0 11224 100664175 /usr/lib64/httpd/modules/mod_logio.so
httpd 14493 root mem REG 253,0 32312 100664172 /usr/lib64/httpd/modules/mod_log_config.so
httpd 14493 root mem REG 253,0 28136 100664167 /usr/lib64/httpd/modules/mod_info.so
httpd 14493 root mem REG 253,0 52536 100664166 /usr/lib64/httpd/modules/mod_include.so
httpd 14493 root mem REG 253,0 23760 100664163 /usr/lib64/httpd/modules/mod_headers.so
httpd 14493 root mem REG 253,0 19424 100664162 /usr/lib64/httpd/modules/mod_filter.so
httpd 14493 root mem REG 253,0 23552 100664160 /usr/lib64/httpd/modules/mod_ext_filter.so
httpd 14493 root mem REG 253,0 15312 100663387 /usr/lib64/httpd/modules/mod_expires.so
httpd 14493 root mem REG 253,0 11184 100663386 /usr/lib64/httpd/modules/mod_env.so
httpd 14493 root mem REG 253,0 11160 100663380 /usr/lib64/httpd/modules/mod_echo.so
httpd 14493 root mem REG 253,0 11200 100663378 /usr/lib64/httpd/modules/mod_dumpio.so
httpd 14493 root mem REG 253,0 15288 100993471 /usr/lib64/httpd/modules/mod_dir.so
httpd 14493 root mem REG 253,0 90248 33562302 /usr/lib64/libz.so.1.2.7
httpd 14493 root mem REG 253,0 31832 100993469 /usr/lib64/httpd/modules/mod_deflate.so
httpd 14493 root mem REG 253,0 23632 100993468 /usr/lib64/httpd/modules/mod_dbd.so
httpd 14493 root mem REG 253,0 11096 100993464 /usr/lib64/httpd/modules/mod_data.so
httpd 14493 root mem REG 253,0 36104 100993459 /usr/lib64/httpd/modules/mod_cache_disk.so
httpd 14493 root mem REG 253,0 73280 100993458 /usr/lib64/httpd/modules/mod_cache.so
httpd 14493 root mem REG 253,0 40080 100993456 /usr/lib64/httpd/modules/mod_autoindex.so
httpd 14493 root mem REG 253,0 7040 100993455 /usr/lib64/httpd/modules/mod_authz_user.so
httpd 14493 root mem REG 253,0 11144 100993454 /usr/lib64/httpd/modules/mod_authz_owner.so
httpd 14493 root mem REG 253,0 11200 100993453 /usr/lib64/httpd/modules/mod_authz_host.so
httpd 14493 root mem REG 253,0 11200 100993452 /usr/lib64/httpd/modules/mod_authz_groupfile.so
httpd 14493 root mem REG 253,0 11216 100993451 /usr/lib64/httpd/modules/mod_authz_dbm.so
httpd 14493 root mem REG 253,0 15304 100993450 /usr/lib64/httpd/modules/mod_authz_dbd.so
httpd 14493 root mem REG 253,0 23752 100993449 /usr/lib64/httpd/modules/mod_authz_core.so
httpd 14493 root mem REG 253,0 19552 100993448 /usr/lib64/httpd/modules/mod_authn_socache.so
httpd 14493 root mem REG 253,0 11176 100993447 /usr/lib64/httpd/modules/mod_authn_file.so
httpd 14493 root mem REG 253,0 11200 100993446 /usr/lib64/httpd/modules/mod_authn_dbm.so
httpd 14493 root mem REG 253,0 15272 100993445 /usr/lib64/httpd/modules/mod_authn_dbd.so
httpd 14493 root mem REG 253,0 15376 100993444 /usr/lib64/httpd/modules/mod_authn_core.so
httpd 14493 root mem REG 253,0 11160 100993443 /usr/lib64/httpd/modules/mod_authn_anon.so
httpd 14493 root mem REG 253,0 36088 100993442 /usr/lib64/httpd/modules/mod_auth_digest.so
httpd 14493 root mem REG 253,0 15336 100993441 /usr/lib64/httpd/modules/mod_auth_basic.so
httpd 14493 root mem REG 253,0 11152 100993439 /usr/lib64/httpd/modules/mod_allowmethods.so
httpd 14493 root mem REG 253,0 15376 100993438 /usr/lib64/httpd/modules/mod_alias.so
httpd 14493 root mem REG 253,0 11176 100993437 /usr/lib64/httpd/modules/mod_actions.so
httpd 14493 root mem REG 253,0 11232 100993436 /usr/lib64/httpd/modules/mod_access_compat.so
httpd 14493 root mem REG 253,0 11448 33561681 /usr/lib64/libfreebl3.so
httpd 14493 root mem REG 253,0 20112 33565434 /usr/lib64/libuuid.so.1.3.0
httpd 14493 root mem REG 253,0 2156240 33555827 /usr/lib64/libc-2.17.so
httpd 14493 root mem REG 253,0 19248 33555833 /usr/lib64/libdl-2.17.so
httpd 14493 root mem REG 253,0 142144 33555853 /usr/lib64/libpthread-2.17.so
httpd 14493 root mem REG 253,0 198704 33555956 /usr/lib64/libapr-1.so.0.4.8
httpd 14493 root mem REG 253,0 1850464 33565441 /usr/lib64/libdb-5.3.so
httpd 14493 root mem REG 253,0 173320 33600743 /usr/lib64/libexpat.so.1.6.0
httpd 14493 root mem REG 253,0 40600 33555831 /usr/lib64/libcrypt-2.17.so
httpd 14493 root mem REG 253,0 172288 33555958 /usr/lib64/libaprutil-1.so.0.5.2
httpd 14493 root mem REG 253,0 155784 33565293 /usr/lib64/libselinux.so.1
httpd 14493 root mem REG 253,0 402384 33565277 /usr/lib64/libpcre.so.1.2.0
httpd 14493 root mem REG 253,0 163312 33554509 /usr/lib64/ld-2.17.so
httpd 14493 root DEL REG 0,4 1019364 /dev/zero
httpd 14493 root DEL REG 0,4 98304 /SYSV72138de1
httpd 14493 root 0r CHR 1,3 0t0 5334 /dev/null
httpd 14493 root 1u unix 0xffff9612b5c4f000 0t0 1019324 socket
httpd 14493 root 2w REG 253,0 6879 442009 /var/log/httpd/error_log
httpd 14493 root 3u sock 0,7 0t0 1019333 protocol: TCP
httpd 14493 root 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14493 root 5r FIFO 0,9 0t0 1019360 pipe
httpd 14493 root 6w FIFO 0,9 0t0 1019360 pipe
httpd 14493 root 7w REG 253,0 18778 442010 /var/log/httpd/access_log
列出多个进程PID所打开的文件信息
[root@localhost ~]# pidof httpd
14498 14497 14496 14495 14494 14493
[root@localhost ~]# lsof -p 14498,14497,14496,14495,14494,14493
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 14493 root cwd DIR 253,0 224 64 /
httpd 14493 root rtd DIR 253,0 224 64 /
httpd 14493 root txt REG 253,0 523608 33597695 /usr/sbin/httpd
httpd 14493 root mem REG 253,0 61560 33555845 /usr/lib64/libnss_files-2.17.so
httpd 14493 root mem REG 253,0 27720 100993461 /usr/lib64/httpd/modules/mod_cgi.so
httpd 14493 root mem REG 253,0 68192 33565440 /usr/lib64/libbz2.so.1.0.6
httpd 14493 root mem REG 253,0 157424 33565432 /usr/lib64/liblzma.so.5.2.2
httpd 14493 root mem REG 253,0 100008 33565453 /usr/lib64/libelf-0.172.so
httpd 14493 root mem REG 253,0 19896 33565264 /usr/lib64/libattr.so.1.1.0
httpd 14493 root mem REG 253,0 88776 33554592 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
httpd 14493 root mem REG 253,0 330464 33602752 /usr/lib64/libdw-0.172.so
httpd 14493 root mem REG 253,0 20032 33565268 /usr/lib64/libcap.so.2.22
httpd 14493 root mem REG 253,0 43712 33555857 /usr/lib64/librt-2.17.so
httpd 14493 root mem REG 253,0 28128 33602757 /usr/lib64/libsystemd-daemon.so.0.0.12
httpd 14493 root mem REG 253,0 11128 100664212 /usr/lib64/httpd/modules/mod_systemd.so
httpd 14493 root mem REG 253,0 19360 100664194 /usr/lib64/httpd/modules/mod_proxy_wstunnel.so
httpd 14493 root mem REG 253,0 19464 100664193 /usr/lib64/httpd/modules/mod_proxy_scgi.so
httpd 14493 root mem REG 253,0 39960 100664192 /usr/lib64/httpd/modules/mod_proxy_http.so
httpd 14493 root mem REG 253,0 44192 100664191 /usr/lib64/httpd/modules/mod_proxy_ftp.so
httpd 14493 root mem REG 253,0 11160 100664190 /usr/lib64/httpd/modules/mod_proxy_fdpass.so
...
列出除了某进程外，其它进程打开的文件信息
[root@localhost ~]# lsof -p ^14498
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,0 224 64 /
systemd 1 root rtd DIR 253,0 224 64 /
systemd 1 root txt REG 253,0 1616360 28617 /usr/lib/systemd/systemd
systemd 1 root mem REG 253,0 20112 33565434 /usr/lib64/libuuid.so.1.3.0
systemd 1 root mem REG 253,0 265624 33565438 /usr/lib64/libblkid.so.1.1.0
systemd 1 root mem REG 253,0 90248 33562302 /usr/lib64/libz.so.1.2.7
systemd 1 root mem REG 253,0 157424 33565432 /usr/lib64/liblzma.so.5.2.2
...
列出所有网络连接信息
[root@localhost ~]# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 4563 root 3u IPv4 1108767 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52059 (ESTABLISHED)
chronyd 5573 chrony 1u IPv4 30342 0t0 UDP localhost:323
chronyd 5573 chrony 2u IPv6 30343 0t0 UDP localhost:323
dhclient 5913 root 7u IPv4 221627 0t0 UDP *:bootpc
sshd 5994 root 3u IPv4 33212 0t0 TCP *:ssh (LISTEN)
sshd 5994 root 4u IPv6 33222 0t0 TCP *:ssh (LISTEN)
sshd 6177 root 3u IPv4 586534 0t0 TCP localhost.localdomain:ssh->192.168.248.16:51235 (ESTABLISHED)
master 6561 root 13u IPv4 34525 0t0 TCP localhost:smtp (LISTEN)
master 6561 root 14u IPv6 34526 0t0 TCP localhost:smtp (LISTEN)
httpd 14493 root 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14494 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14495 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14496 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14497 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14498 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
dhclient 16229 root 6u IPv4 43966 0t0 UDP *:bootpc
sshd 21803 root 3u IPv4 1047169 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52042 (ESTABLISHED)
sshd 29553 root 3u IPv4 1078041 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52054 (ESTABLISHED)
列出所有tcp网络连接信息
[root@localhost ~]# lsof -i tcp
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 4563 root 3u IPv4 1108767 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52059 (ESTABLISHED)
sshd 5994 root 3u IPv4 33212 0t0 TCP *:ssh (LISTEN)
sshd 5994 root 4u IPv6 33222 0t0 TCP *:ssh (LISTEN)
sshd 6177 root 3u IPv4 586534 0t0 TCP localhost.localdomain:ssh->192.168.248.16:51235 (ESTABLISHED)
master 6561 root 13u IPv4 34525 0t0 TCP localhost:smtp (LISTEN)
master 6561 root 14u IPv6 34526 0t0 TCP localhost:smtp (LISTEN)
httpd 14493 root 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14494 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14495 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14496 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14497 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14498 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
sshd 21803 root 3u IPv4 1047169 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52042 (ESTABLISHED)
sshd 29553 root 3u IPv4 1078041 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52054 (ESTABLISHED)
列出所有udp网络连接信息
[root@localhost ~]# lsof -i udp
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chronyd 5573 chrony 1u IPv4 30342 0t0 UDP localhost:323
chronyd 5573 chrony 2u IPv6 30343 0t0 UDP localhost:323
dhclient 5913 root 7u IPv4 221627 0t0 UDP *:bootpc
dhclient 16229 root 6u IPv4 43966 0t0 UDP *:bootpc
列出谁在使用某端口
[root@localhost ~]# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 4563 root 3u IPv4 1108767 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52059 (ESTABLISHED)
sshd 5994 root 3u IPv4 33212 0t0 TCP *:ssh (LISTEN)
sshd 5994 root 4u IPv6 33222 0t0 TCP *:ssh (LISTEN)
sshd 6177 root 3u IPv4 586534 0t0 TCP localhost.localdomain:ssh->192.168.248.16:51235 (ESTABLISHED)
sshd 21803 root 3u IPv4 1047169 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52042 (ESTABLISHED)
sshd 29553 root 3u IPv4 1078041 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52054 (ESTABLISHED)
列出谁在使用特定协议端口
[root@localhost ~]# lsof -i tcp:80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 14493 root 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14494 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14495 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14496 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14497 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
httpd 14498 apache 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
列出某个用户的所有活跃网络接口
[root@localhost ~]# lsof -a -u root -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 4563 root 3u IPv4 1108767 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52059 (ESTABLISHED)
dhclient 5913 root 7u IPv4 221627 0t0 UDP *:bootpc
sshd 5994 root 3u IPv4 33212 0t0 TCP *:ssh (LISTEN)
sshd 5994 root 4u IPv6 33222 0t0 TCP *:ssh (LISTEN)
sshd 6177 root 3u IPv4 586534 0t0 TCP localhost.localdomain:ssh->192.168.248.16:51235 (ESTABLISHED)
master 6561 root 13u IPv4 34525 0t0 TCP localhost:smtp (LISTEN)
master 6561 root 14u IPv6 34526 0t0 TCP localhost:smtp (LISTEN)
httpd 14493 root 4u IPv6 1019334 0t0 TCP *:http (LISTEN)
dhclient 16229 root 6u IPv4 43966 0t0 UDP *:bootpc
sshd 21803 root 3u IPv4 1047169 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52042 (ESTABLISHED)
sshd 29553 root 3u IPv4 1078041 0t0 TCP localhost.localdomain:ssh->192.168.248.17:52054 (ESTABLISHED)
