Does lsof always show the resolved absolute pathnames of opened files

lsof

In the output of lsof, does the NAME column always output the resolved absolute pathnames of opened files (resolved in the sense of no symlink, . or .. in the pathname)?

For example, if I cd into some symlink to a directory, and then run a program to open a file under that directory, does lsof only show the resolved absolute pathname of the file?

Can I make lsof output the unresolved absolute pathnames of opened files (unresolved in the sense that directory symlinks should appear in pathnames)?

Thanks.

Best Answer

Without options, it should provide pathnames in resolved form. From lsof(8) manual:

An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path.

There can of course be errors, such as pathname too long, in which case pathname won't be resolved, but otherwise lsof relies apparently on a wrapper function around readlink(), which should do the job.

If you do specify a filename as in lsof [options] [--] names, it should be resolved:

names These are path names of specific files to list. Symbolic links are resolved before use. The first name may be separated from the preceding options with the ''--'' option.

Of course, standard rules for resolving filenames apply. Too many levels of symlinks will result in an error. lsof relies on MAXSYMLINKS variable hardcoded in the Linux kernel to max level of 40 symlinks, and for other systems where the variable is undefined - sets that to 32.

If you do specify -b option, filenames won't be resolved:

Third, if the names of your file system directories that lsof obtains from your system's mount table are symbolic links, lsof won't be able to resolve the links. This is because the -b option causes lsof to avoid the kernel readlink(2) function it uses to resolve symbolic links.

Related Solutions

lsof – Show Files Open as Read-Write

To answer this question specifically, you could do:

lsof /foo | awk 'NR==1 || $4~/[0-9]+u/'

This will show files which are opened read-write under the mount point foo. However, likely you really want to do is list all files which are open for writing. This would include files a which opened write-only as well as those opened read-write. For this you would do:

lsof /foo | awk 'NR==1 || $4~/[0-9]+[uw]/'

These commands should work provided FD is the 4th field in the output and none of the other fields are blank. This is the case for me on Debian when I include a path in the lsof command, however if I don't it prints and extra TID field which is sometimes blank (and will confuse awk). Mileage may vary between distros or lsof versions.

Lsof misses files

Gedit reads the file into memory then closes the file handle. Typically:

open("/path/to/your/file", O_RDONLY|O_LARGEFILE|O_NOATIME) = 18
read(18, "blah blah blah"..., 4096) = 305
close(18)                           = 0

or some mmap or other way. (Not sure how exactly it reads files, but point is that it does not keep the files open.)

After this it keeps polling to check if it has changed. And re-open on write.

Best Answer

Related Solutions

lsof – Show Files Open as Read-Write

Lsof misses files

Related Question