lsof - List open *files*?

I can't address all of your questions but I've discovered that some applications will read a file (which doesn't require the file to be opened) and then hold the data in memory. The file isn't opened for writing until it is saved to disk. It's been a while since I stumbled onto this but I think I was working with text files in BBEdit and/or TextEdit.

-- Rob (a shell novice who could be mistaken)

Reading

man lsof

then eventually getting back to us with specific problems is probably the way to go, even if that is not exactly a tutorial...

1) As robJ has pointed out, many apps will open a file, copy all the data into memory and then close the file. If you save the file, it will open the file again, save the data, then close the file. So a file is not necessarily open in the Unix sense even when it is "open" in an editor. This was the subject of some discussion in this old thread:
http://forums.macosxhints.com/showthread.php?s=&threadid=15477

2) As voldenuit has perhaps implied, if you tell us your higher-level goals, maybe we could help you. What are you trying to accomplish?

3) Unix considers almost everything a file in the sense of a source & destination for data.

4) The usual way to handle columns of info from programs that are not configurable is to remove them with 'perl' or 'awk'.

As voldenuit has perhaps implied, if you tell us your higher-level goals, maybe we could help you. What are you trying to accomplish?

I'm sorry, I really have no higher-level goals. I'm just trying to filter the output from the lsof command to a format I can understand. I hate sifting through pages and pages of meaningless (to me) information.

I wanted it to display open 'files', no /dev/ stuff or 0x0 stuff or things which have type IPv4. It's easy to filter those out using grep, but I just wondered if I could have files which are 'open' in an application (but perhaps not actually 'open' in the unix sense) appear in the list.

Plus I was hoping to remove the columns I don't understand, but I have no experience with perl or awk. Can anyone give an example of a command that could do what I'm after?

lsof is crammed with options:

$ lsof -h
lsof 4.73
latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
usage: [-?abhlnNoOPRstUvV] [+|-c c] [+|-d s] [+D D] [+|-f[cfgGn]]
[-F [f]] [-g [s]] [-i [i]] [-k k] [+|-L [l]] [-m m] [+|-M] [-o [o]]
[-p s] [+|-r [t]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]
Defaults in parentheses; comma-separate set (s) items; dash-separate ranges.
-?|-h list help -a AND selections (OR) -b avoid kernel blocks
-c c cmd c, /c/[bix] +c w COMMAND width (9)
+d s dir s files -d s select by FD set +D D dir D tree *SLOW?*
-i select IPv[46] files -l list UID numbers
-n no host names -N select NFS files -o list file offset
-O avoid overhead *RISK -P no port names -R list paRent PID
-s list file size -t terse listing -T disable TCP/TPI info
-U select Unix socket -v list version info -V verbose search
+|-w Warnings (+) -- end option scan
+f|-f +filesystem or -file names +|-f[cfgGn] Ct,Fstr,flaGs,Node
-F [f] select fields; -F? for help -k k kernel symbols (/mach_kernel)
+|-L [l] list (+) suppress (-) link counts < l (0 = all; default = 0)
-m m kernel memory (/dev/kmem)
+|-M portMap registration (-) -o o o 0t offset digits (8)
-p s select by PID set -S [t] t second stat timeout (15)
-T fqs TCP/TPI Fl,Q,St (s) info
-g [s] select by process group ID set and print process group IDs
-i i select by IPv[46] address: [46][proto][@host|addr][:svc_list|port_list]
+|-r [t] repeat every t seconds (15); + until no files, - forever
-u s exclude(^)|select login|UID set s
-x [fl] cross over +d|+D File systems or symbolic Links
names select named files or files on named file systems
Only root can list all files; /dev warnings enabled; kernel ID check disabled.

Read the manpage, really.

I'm sorry, I really have no higher-level goals.
What - you are just doing this for the fun of it? There presumably was a reason why you started writing this script and trying to find out about open files.

I just wondered if I could have files which are 'open' in an application (but perhaps not actually 'open' in the unix sense) appear in the list.

Since 'lsof' is a Unix command, it is only going to tell you about files that are open in the Unix sense.

What - you are just doing this for the fun of it?

Well, yes i suppose. As I said before, I want the lsof command to be useful to me. I want to filter its output into a form that tells me something. If you count that as a high-level goal, I guess that is it.

Since 'lsof' is a Unix command, it is only going to tell you about files that are open in the Unix sense.

Yes, that's what I guessed from robJ's post. Seems reasonable. Are there any other commands that could give information about other 'open' files, maybe by scanning the RAM to find references to them? If this is a stupid question, sorry, but this is the Unix Newcomer's forum, isn't it?

voldenuit - OK, it's great that lsof has heaps of options. But from my initial read of the man page, it has no options to do what I want. However, I've heard Unix savvy people say often that there are *always* other ways of doing things. I was just wondering if anyone knew any of these other ways.

robJ - thanks for your original post, it made a lot of sense to a unix novice such as me. It's interesting, though, that some programs (Word) always have files listed in lsof while they're open, including several temporary ones, while others don't.

I'm starting to realise that lsof may not be quite what I was hoping for. I obviously interpreted the 'open files' in the man page wrongly. My apologies.

I'm starting to realise that lsof may not be quite what I was hoping for.

So what is it that you are looking for?
You said before that you wanted to find all "open" files in the sense of files being open for editing by an application.
My question (still unanswered) about your higher-level goals was asking why do you want to do this.

I've heard Unix savvy people say often that there are *always* other ways of doing things. I was just wondering if anyone knew any of these other ways.

Just for future reference, here's one way to use Perl to extract just the columns you want from the output of a command that uses spaces (or tabs) to separate its output. Suppose you wanted the 4th column of the output of 'lsof'. Counting the first column as index 0, the 4th column has index 3, so the following command would extract that column:

lsof | perl -ne '@cols = split; print "$cols[3]\n"'

If the column separators are something different, you could supply a pattern to Perl's 'split' function.

My question (still unanswered) about your higher-level goals was asking why do you want to do this.
OK, I don't want to get caught up in semantics here. But perhaps I wasn't quite clear in my earlier posts: *I want to make lsof comprehensible*. That is my high-level goal. I had intended to write a one-line script that filtered the information I wanted from the lsof command and output it to the terminal screen. I would then name this "lsf" or similar and put it in the /usr/local/bin/ folder, so I could access it instead of lsof.

Why do I want to do that? Well, I don't know. Why do I use the 'top' command for instance? Because I like knowing what's going on with my computer, I suppose. I may even, if it works, use it over ssh to check what files another computer has open. I'm afraid I can't give you a better answer than that.

lsof | perl -ne '@cols = split; print "$cols[3]\n"'
That command works as described. I don't have a clue how, but it does. Thanks. Any way of getting it to output more than one column? I tried putting in $cols[3,4] but that doesn't work.

I want to make lsof comprehensible. That is my high-level goal.
[...]
Why do I want to do that? Well, I don't know. Why do I use the 'top' command for instance? Because I like knowing what's going on with my computer, I suppose.

In the case of 'top', the higher-level goal is usually that you want to see what is taking up CPU (or memory) so that you can make your computer perform better - i.e. you usually look at 'top' when something isn't going as fast as you thought it should be. It isn't usually idle curiosity.

If indeed you are driven merely by curiosity to know the output of 'lsof' (I say it that way since as discussed above, it doesn't show you what files are open in the sense of being edited by an app) then that's fine. It's just that I imagined that you had some other reason that prompted you to write this script - some other problem you were trying to solve - and if you told us that, we might be able to suggest a better solution.


Any way of getting it to output more than one column? I tried putting in $cols[3,4] but that doesn't work.

$cols[3] refers to the index=3 element of the array and hence gets substituted with the current value at that index.
If you want to print out the index=4 element of the array, you would add $cols[4] to the 'print' statement. For example:

lsof | perl -ne '@cols = split; print "$cols[3] $cols[4]\n"'

Thanks for that perl code. It's just what I wanted.

And yes, I was motivated mainly by interest about what files I have open at a given time. I sometimes like using the command to find the resource files an application is accessing if I want to tweak something, or, as I said, it may be useful to me via ssh.

I sometimes like using the command to find the resource files an application is accessing if I want to tweak something

Most apps will read their support files, get the necessary info, then close them. So you are unlikely to see the support files show up in 'lsof'.
Instead, you might like to look at the output of 'sudo fs_usage'