Lsof misses files

filesystemslsofprocesses

Why does lsof fail to list files I have open. For example I open with the text editor some file in my home directory.

$ gedit ~/.python_history

lsof does not even work as root

$ sudo lsof | grep python_history

does not list anything. Why?

Editing and saving the file does not make a difference either. Running the python interpreter does not make a difference either.

$ lsof | grep gedit

does list a bunch of files, but not those I am editing.

Best Answer

Gedit reads the file into memory then closes the file handle. Typically:

open("/path/to/your/file", O_RDONLY|O_LARGEFILE|O_NOATIME) = 18
read(18, "blah blah blah"..., 4096) = 305
close(18)                           = 0

or some mmap or other way. (Not sure how exactly it reads files, but point is that it does not keep the files open.)

After this it keeps polling to check if it has changed. And re-open on write.

Related Question