Lsof -p PID vs lsof | grep PID

lsofprocess

I do not understand the ouput of the lsof command.

When i write 

lsof -p PID

I get 4 lines and when I write 

lsof | grep PID

I get hundreds of lines.

Shouldn't it return the same result?

Thank you for your responses. Here are output. Looks like it is sub process or what this tasks mean?

lsof -p 29076
COMMAND   PID  USER   FD      TYPE DEVICE SIZE/OFF NODE NAME
java    29076  pr    cwd   unknown                      /proc/29076/cwd (readlink: Permission denied)
java    29076  pr    rtd   unknown                      /proc/29076/root (readlink: Permission denied)
java    29076  pr    txt   unknown                      /proc/29076/exe (readlink: Permission denied)
java    29076  pr   NOFD                                /proc/29076/fd (opendir: Permission denied)

lsof |grep 29076|head -20
java      29076        pr  cwd   unknown                          /proc/29076/cwd (readlink: Permission denied)
java      29076        pr  rtd   unknown                          /proc/29076/root (readlink: Permission denied)
java      29076        pr  txt   unknown                          /proc/29076/exe (readlink: Permission denied)
java      29076        pr NOFD                                    /proc/29076/fd (opendir: Permission denied)
java      29076   300  pr  cwd   unknown                          /proc/29076/task/300/cwd (readlink: Permission denied)
java      29076   300  pr  rtd   unknown                          /proc/29076/task/300/root (readlink: Permission denied)
java      29076   300  pr  txt   unknown                          /proc/29076/task/300/exe (readlink: Permission denied)
java      29076   300  pr NOFD                                    /proc/29076/task/300/fd (opendir: Permission denied)
java      29076   329  pr  cwd   unknown                          /proc/29076/task/329/cwd (readlink: Permission denied)
java      29076   329  pr  rtd   unknown                          /proc/29076/task/329/root (readlink: Permission denied)
java      29076   329  pr  txt   unknown                          /proc/29076/task/329/exe (readlink: Permission denied)
java      29076   329  pr NOFD                                    /proc/29076/task/329/fd (opendir: Permission denied)
java      29076   330  pr  cwd   unknown                          /proc/29076/task/330/cwd (readlink: Permission denied)
java      29076   330  pr  rtd   unknown                          /proc/29076/task/330/root (readlink: Permission denied)
java      29076   330  pr  txt   unknown                          /proc/29076/task/330/exe (readlink: Permission denied)
java      29076   330  pr NOFD                                    /proc/29076/task/330/fd (opendir: Permission denied)
java      29076   331  pr  cwd   unknown                          /proc/29076/task/331/cwd (readlink: Permission denied)
java      29076   331  pr  rtd   unknown                          /proc/29076/task/331/root (readlink: Permission denied)
java      29076   331  pr  txt   unknown                          /proc/29076/task/331/exe (readlink: Permission denied)
java      29076   331  pr NOFD                                    /proc/29076/task/331/fd (opendir: Permission denied)

Best Answer

Without seeing the actual output it's hard to say exactly what is happening but I'm guessing it's caused by the fact that the lsof -p PID command is just printing out files that are opened by the specified PID while the lsof | grep PID is printing out any lines where 'PID' is located anywhere in the line. For example, if you're searching for PID=123 then your grep option will also print lines for PID's 1231, 1232, 1233, etc. as well as any files which are located in folders with 123 anywhere in their full path.

EDIT: In your specific example the difference is that lsof is ignoring files opened by a thread. If you look at the output in the grep example the third column is the 'TID' or Thread ID. Lines without a TID match what you were seeing when you used the -p option. Lines with a TID (ie. lines opened by other threads) are the extras.

Related Question