Linux – When looking at lsof output, what does “0t0” mean

linuxlsof

When looking at lsof output, what does "0t0" mean?

Best Answer

Since you have not given any information on where you see this I will assume you are running GNU lsof with no arguments and you see 0t0 in the SIZE/OFF column. This, by default, shows the size of the file in question.

However, for "special" files, it gives the offset instead. From the lsof man page:

SIZE, SIZE/OFF, or OFFSET
   is the size of the file or the file offset in bytes. A value is displayed in
   this column only if it is available. Lsof displays whatever value - size or 
   offset - is appropriate for the type of the file and the version of lsof. 
On some UNIX dialects
    lsof can't obtain accurate or consistent file offset information from its
    kernel data sources, sometimes just for particular kinds of files (e.g., 
   socket files.) In other cases, files don't have true sizes - e.g., sockets, 
   FIFOs, pipes - so lsof displays for their sizes the content amounts it finds in 
   their kernel buffer descriptors (e.g., socket buffer size counts or TCP/IP 
   window sizes.) Consult the lsof FAQ (The FAQ section gives its location.) for 
   more information. 
The file size is displayed in decimal;
    the offset is normally displayed in decimal with a leading ''0t'' if it 
   contains 8 digits or less; in hexadecimal with a leading ''0x'' if it is 
   longer than 8 digits. (Consult the -o o option description for information 
   on when 8 might default to some other value.) 
Thus the leading ''0t'' and ''0x'' identify an offset when the column
    may contain both a size and an offset (i.e., its title is SIZE/OFF).

In other words, 0t signifies decimal notation and 0t0 means a file with size 0 in decimal notation. You can confirm by having a look at what files have that size (this is run on a Debian box):

lsof | grep 0t0 | awk '{print $(NF-2),$NF}' | sort -u

You will see that all files with that reported size will be things like sockets, pipes, open TCP connections, devices and the like.

Related Question