Separate lsof output by column

lsoftext processing

I am using this command below and trying to separate the columns I only want to get the PID to use it in my python script.

I can easily get this line by line but then how to separate into columns in a non hacky way?

I can easily split by space but lets face it that is a terrible idea, any suggestions?

root@python-VirtualBox:/var/python# lsof | grep TCP
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    3449 root    3u  IPv4  24248      0t0  TCP *:22 (LISTEN)
sshd    3449 root    4u  IPv6  24257      0t0  TCP *:22 (LISTEN)

Best Answer

I think awk is good for this because it splits fields for you:

lsof | awk '$8 == "TCP" { print $2 }'

If field 8 is "TCP", then print field 2.

FD - File Descriptor

If you are looking for file being written, look for following flag

# - The number in front of flag(s) is the file descriptor number of used by the process to associated with the file
u - File open with Read and Write permission
r - File open with Read permission
w - File open with Write permission
W - File open with Write permission and with Write Lock on entire file
mem - Memory mapped file, usually for share library

So 3r means webalizer has a descriptor number 3 associated with ...dns_cache.db, with read permission.

TYPE - File Type

In Linux, almost everything are files, but with different type.

REG - REGgular file, file that show up in directory
DIR - Directory

NODE

inode number in filesystem

You can find complete details in the man page.

Python – Custom lsof output

lsof has a "post-processable" output format with the -F option (see the OUTPUT FOR OTHER PROGRAMS section in the manual).

lsof -nPMp "$pid" -Fn | sed '
  \|^n/|!d
  s/ type=STREAM$//; t end
  s/ type=DGRAM$//; t end
  s/ type=SEQPACKET$//
  : end
  s|^n||'

Will list open files that resolve to a path on the file system.

-nPM disables some of the processing that lsof does by default and which we don't care for here like resolving IP adresses, port or rpc names.
-p "$pid", specify the process whose open files to list
-Fn: by field output. Ask for the name part.
| sed post process with sed to select only the part we're interested in:
\|^n/|!d: skip anything that doesn't start with n/
s/ type=...$/;t end: remove those strings at the end of the line and jump to the end label if successful.
: end: the end label.
s|^n||: remove the leading n character that lsof inserts to identify the field being output.

However note that non-printable characters in file names are encoded (like \n for newline, ^[ for ESC...) in an ambiguous way (as in ^[ could mean either ^[ and ESC).

Also, for deleted files, on Linux at least, you'll still get a file path but with (deleted) appended. Again, no way to discriminate between a deleted file and a file whose name ends in (deleted). Looking at the link count will not necessarily help as the deleted file could be linked elsewhere.

See also the removing of type=* which we do for Unix domain sockets that may have actually occurred in the file name.

What that means is that though it will work in most cases, you can't post-process that output reliably in the general case.

Not to mention that lsof itself may fail to parse the information returned by the kernel correctly, or that the kernel may fail to provide that information in a reliably parseable format

Best Answer

Related Solutions

How to interpret this output of lsof command

FD - File Descriptor

TYPE - File Type

NODE

Python – Custom lsof output

Related Question