{ "content": [ { "type": "text", "text": "# LSFD (man)\n\n## NAME\n\nlsfd - list file descriptors\n\n## SYNOPSIS\n\nlsfd [option]\n\n## DESCRIPTION\n\nlsfd is intended to be a modern replacement for lsof(8) on Linux systems. Unlike lsof, lsfd\nis specialized to Linux kernel; it supports Linux specific features like namespaces with\nsimpler code. lsfd is not a drop-in replacement for lsof; they are different in the command\nline interface and output formats.\n\n## TLDR\n\n> List open files and the corresponding processes in Linux.\n\n- List all open file descriptors:\n `lsfd`\n- List all files kept open by a specific program:\n `lsfd {{-Q|--filter}} 'PID == {{process_id}}'`\n- Check what program has a specific file open:\n `lsfd {{-Q|--filter}} \"NAME == '{{path/to/file}}'\"`\n- List open IPv4 or IPv6 sockets:\n `lsfd {{i4|-i6}}`\n- Display help:\n `lsfd {{-h|--help}}`\n\n*Source: tldr-pages*\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **OPTIONS** (14 subsections)\n- **OUTPUT COLUMNS**\n- **FILTER EXPRESSION** (2 subsections)\n- **FILTER EXAMPLES**\n- **COUNTER EXAMPLES**\n- **HISTORY**\n- **AUTHORS**\n- **SEE ALSO**\n- **REPORTING BUGS**\n- **AVAILABILITY**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "LSFD", "section": "", "mode": "man", "summary": "lsfd - list file descriptors", "synopsis": "lsfd [option]", "tldr_summary": "List open files and the corresponding processes in Linux.", "tldr_examples": [ { "description": "List all open file descriptors", "command": "lsfd" }, { "description": "List all files kept open by a specific program", "command": "lsfd {{-Q|--filter}} 'PID == {{process_id}}'" }, { "description": "Check what program has a specific file open", "command": "lsfd {{-Q|--filter}} \"NAME == '{{path/to/file}}'\"" }, { "description": "List open IPv4 or IPv6 sockets", "command": "lsfd {{i4|-i6}}" }, { "description": "Display help", "command": "lsfd {{-h|--help}}" } ], "tldr_source": "official", "flags": [ { "flag": "-l", "long": "--threads", "arg": null, "description": "List in threads level." }, { "flag": "-J", "long": "--json", "arg": null, "description": "Use JSON output format." }, { "flag": "-n", "long": "--noheadings", "arg": null, "description": "Don’t print headings." }, { "flag": "-o", "long": "--output", "arg": null, "description": "Specify which output columns to print. See the OUTPUT COLUMNS section for details of available columns. The default list of columns may be extended if list is specified in the format +list (e.g., lsfd -o +DELETED)." }, { "flag": "-r", "long": "--raw", "arg": null, "description": "Use raw output format." }, { "flag": "", "long": "--notruncate", "arg": null, "description": "Don’t truncate text in columns." }, { "flag": "-p", "long": "--pid", "arg": null, "description": "Collect information only for specified processes. pids is a list of pids. A comma or whitespaces can be used as separators. You can use this option with pidof(1). See FILTER EXAMPLES. Both -Q option with an expression including PID, e.g. -Q (PID == 1), and -p option, e.g. -p 1, may print the same output but using -p option is much more efficient because -p option works at a much earlier stage of processing than the -Q option." }, { "flag": "-i", "long": "--inet", "arg": null, "description": "List only IPv4 sockets and/or IPv6 sockets." }, { "flag": "-Q", "long": "--filter", "arg": null, "description": "Print only the files matching the condition represented by the expr. See also FILTER EXAMPLES." }, { "flag": "-C", "long": "--counter", "arg": null, "description": "Define a custom counter used in --summary output. lsfd makes a counter named label. During collect information, lsfd counts files matching filterexpr, and stores the counted number to the counter named label. lsfd applies filters defined with --filter options before counting; files excluded by the filters are not counted. See FILTER EXPRESSION about filterexpr. label should not include { nor :. You can define multiple counters by specifying this option multiple times. See also COUNTER EXAMPLES. --summary[=when] This option controls summary lines output. The optional argument when can be only, append or never. If the when argument is omitted, it defaults to only. The summary reports counters. A counter consists of a label and an integer value. --counter is the option for defining a counter. If a user defines no counter, lsfd uses the definitions of pre-defined built-in counters (default counters) to make the summary output. CAUTION: Using --summary and --json may make the output broken. Only combining --summary=only and --json is valid." }, { "flag": "", "long": "--debug-filter", "arg": null, "description": "Dump the internal data structure for the filter and exit. This is useful only for lsfd developers." }, { "flag": "", "long": "--dump-counters", "arg": null, "description": "Dump the definition of counters used in --summary output." }, { "flag": "-h", "long": "--help", "arg": null, "description": "Display help text and exit." }, { "flag": "-V", "long": "--version", "arg": null, "description": "Print version and exit." } ], "examples": [], "see_also": [ { "name": "lsof", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/lsof/8/json" }, { "name": "pidof", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/pidof/1/json" }, { "name": "proc", "section": "5", "url": "https://www.chedong.com/phpMan.php/man/proc/5/json" }, { "name": "socket", "section": "2", "url": "https://www.chedong.com/phpMan.php/man/socket/2/json" }, { "name": "stat", "section": "2", "url": "https://www.chedong.com/phpMan.php/man/stat/2/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 2, "subsections": [] }, { "name": "DESCRIPTION", "lines": 13, "subsections": [] }, { "name": "OPTIONS", "lines": 1, "subsections": [ { "name": "-l --threads", "lines": 2, "flag": "-l", "long": "--threads" }, { "name": "-J --json", "lines": 2, "flag": "-J", "long": "--json" }, { "name": "-n --noheadings", "lines": 2, "flag": "-n", "long": "--noheadings" }, { "name": "-o --output _", "lines": 6, "flag": "-o", "long": "--output" }, { "name": "-r --raw", "lines": 2, "flag": "-r", "long": "--raw" }, { "name": "--notruncate", "lines": 2, "long": "--notruncate" }, { "name": "-p --pid _", "lines": 8, "flag": "-p", "long": "--pid" }, { "name": "-i --inet", "lines": 2, "flag": "-i", "long": "--inet" }, { "name": "-Q --filter _", "lines": 3, "flag": "-Q", "long": "--filter" }, { "name": "-C --counter _", "lines": 22, "flag": "-C", "long": "--counter" }, { "name": "--debug-filter", "lines": 3, "long": "--debug-filter" }, { "name": "--dump-counters", "lines": 2, "long": "--dump-counters" }, { "name": "-h --help", "lines": 2, "flag": "-h", "long": "--help" }, { "name": "-V --version", "lines": 2, "flag": "-V", "long": "--version" } ] }, { "name": "OUTPUT COLUMNS", "lines": 287, "subsections": [] }, { "name": "FILTER EXPRESSION", "lines": 39, "subsections": [ { "name": "Limitations", "lines": 5 }, { "name": "Semi-formal syntax", "lines": 57 } ] }, { "name": "FILTER EXAMPLES", "lines": 72, "subsections": [] }, { "name": "COUNTER EXAMPLES", "lines": 26, "subsections": [] }, { "name": "HISTORY", "lines": 2, "subsections": [] }, { "name": "AUTHORS", "lines": 2, "subsections": [] }, { "name": "SEE ALSO", "lines": 2, "subsections": [] }, { "name": "REPORTING BUGS", "lines": 2, "subsections": [] }, { "name": "AVAILABILITY", "lines": 4, "subsections": [] } ], "sections": { "NAME": { "content": "lsfd - list file descriptors\n", "subsections": [] }, "SYNOPSIS": { "content": "lsfd [option]\n", "subsections": [] }, "DESCRIPTION": { "content": "lsfd is intended to be a modern replacement for lsof(8) on Linux systems. Unlike lsof, lsfd\nis specialized to Linux kernel; it supports Linux specific features like namespaces with\nsimpler code. lsfd is not a drop-in replacement for lsof; they are different in the command\nline interface and output formats.\n\nThe default output is subject to change. So whenever possible, you should avoid using default\noutputs in your scripts. Always explicitly define expected columns by using --output\ncolumns-list in environments where a stable output is required.\n\nlsfd uses Libsmartcols for output formatting and filtering. See the description of --output\noption for customizing the output format, and --filter option for filtering. Use lsfd --help\nto get a list of all available columns.\n", "subsections": [] }, "OPTIONS": { "content": "", "subsections": [ { "name": "-l --threads", "content": "List in threads level.\n", "flag": "-l", "long": "--threads" }, { "name": "-J --json", "content": "Use JSON output format.\n", "flag": "-J", "long": "--json" }, { "name": "-n --noheadings", "content": "Don’t print headings.\n", "flag": "-n", "long": "--noheadings" }, { "name": "-o --output _", "content": "Specify which output columns to print. See the OUTPUT COLUMNS section for details of\navailable columns.\n\nThe default list of columns may be extended if list is specified in the format +list\n(e.g., lsfd -o +DELETED).\n", "flag": "-o", "long": "--output" }, { "name": "-r --raw", "content": "Use raw output format.\n", "flag": "-r", "long": "--raw" }, { "name": "--notruncate", "content": "Don’t truncate text in columns.\n", "long": "--notruncate" }, { "name": "-p --pid _", "content": "Collect information only for specified processes. pids is a list of pids. A comma or\nwhitespaces can be used as separators. You can use this option with pidof(1). See FILTER\nEXAMPLES.\n\nBoth -Q option with an expression including PID, e.g. -Q (PID == 1), and -p option, e.g.\n-p 1, may print the same output but using -p option is much more efficient because -p\noption works at a much earlier stage of processing than the -Q option.\n", "flag": "-p", "long": "--pid" }, { "name": "-i --inet", "content": "List only IPv4 sockets and/or IPv6 sockets.\n", "flag": "-i", "long": "--inet" }, { "name": "-Q --filter _", "content": "Print only the files matching the condition represented by the expr. See also FILTER\nEXAMPLES.\n", "flag": "-Q", "long": "--filter" }, { "name": "-C --counter _", "content": "Define a custom counter used in --summary output. lsfd makes a counter named label.\nDuring collect information, lsfd counts files matching filterexpr, and stores the\ncounted number to the counter named label. lsfd applies filters defined with --filter\noptions before counting; files excluded by the filters are not counted.\n\nSee FILTER EXPRESSION about filterexpr. label should not include { nor :. You can define\nmultiple counters by specifying this option multiple times.\n\nSee also COUNTER EXAMPLES.\n\n--summary[=when]\nThis option controls summary lines output. The optional argument when can be only, append\nor never. If the when argument is omitted, it defaults to only.\n\nThe summary reports counters. A counter consists of a label and an integer value.\n--counter is the option for defining a counter. If a user defines no counter, lsfd uses\nthe definitions of pre-defined built-in counters (default counters) to make the summary\noutput.\n\nCAUTION: Using --summary and --json may make the output broken. Only combining\n--summary=only and --json is valid.\n", "flag": "-C", "long": "--counter" }, { "name": "--debug-filter", "content": "Dump the internal data structure for the filter and exit. This is useful only for lsfd\ndevelopers.\n", "long": "--debug-filter" }, { "name": "--dump-counters", "content": "Dump the definition of counters used in --summary output.\n", "long": "--dump-counters" }, { "name": "-h --help", "content": "Display help text and exit.\n", "flag": "-h", "long": "--help" }, { "name": "-V --version", "content": "Print version and exit.\n", "flag": "-V", "long": "--version" } ] }, "OUTPUT COLUMNS": { "content": "Each column has a type. Types are surround by < and >.\n\nCAUTION: The names and types of columns are not stable yet. They may be changed in the future\nreleases.\n\nAINODECLASS \nClass of anonymous inode.\n\nASSOC \nAssociation between file and process.\n\nBLKDRV \nBlock device driver name resolved by /proc/devices.\n\nCHRDRV \nCharacter device driver name resolved by /proc/devices.\n\nCOMMAND \nCommand of the process opening the file.\n\nDELETED \nReachability from the file system.\n\nDEV \nID of the device containing the file.\n\nDEVTYPE \nDevice type (blk, char, or nodev).\n\nENDPOINT \nIPC endpoints information communicated with the fd. The format of the column depends on\nthe object associated with the fd:\n\nFIFO type\nPID,COMMAND,ASSOC[-r][-w]\n\nThe last characters ([-r][-w]) represents the read and/or write mode of the endpoint.\n\nlsfd collects endpoints within the processes that lsfd scans; lsfd may miss some\nendpoints if you limits the processes with -p option.\n\nFD \nFile descriptor for the file.\n\nFLAGS \nFlags specified when opening the file.\n\nFUID \nUser ID number of the file’s owner.\n\nINET.LADDR \nLocal IP address.\n\nINET.RADDR \nRemote IP address.\n\nINET6.LADDR \nLocal IP6 address.\n\nINET6.RADDR \nRemote IP6 address.\n\nINODE \nInode number.\n\nKNAME \nRaw file name extracted from from /proc/pid/fd/fd or /proc/pid/mapfiles/region.\n\nKTHREAD \nWhether the process is a kernel thread or not.\n\nMAJ:MIN \nDevice ID for special, or ID of device containing file.\n\nMAPLEN \nLength of file mapping (in page).\n\nMISCDEV \nMisc character device name resolved by /proc/misc.\n\nMNTID \nMount ID.\n\nMODE \nAccess mode (rwx).\n\nNAME \nCooked version of KNAME. It is mostly same as KNAME.\n\nSome files have special formats and information sources:\n\nNETLINK\nprotocol=NETLINK.PROTOCOL[ lport=NETLINK.LPORT[ group=NETLINK.GROUPS]]\n\nPACKET\ntype=SOCK.TYPE[ protocol=PACKET.PROTOCOL][ iface=PACKET.IFACE]\n\npidfd\npid=TARGET-PID comm=TARGET-COMMAND nspid=TARGET-NSPIDS\n\nlsfd extracts TARGET-PID and TARGET-NSPIDS from /proc/pid/fdinfo/fd.\n\nPING\nstate=SOCK.STATE[ id=PING.ID][ laddr=INET.LADDR [ raddr=INET.RADDR]]\n\nPINGv6\nstate=SOCK.STATE[ id=PING.ID][ laddr=INET6.LADDR [ raddr=INET6.RADDR]]\n\nRAW\nstate=SOCK.STATE[ protocol=RAW.PROTOCOL [ laddr=INET.LADDR [ raddr=INET.RADDR]]]\n\nRAWv6\nstate=SOCK.STATE[ protocol=RAW.PROTOCOL [ laddr=INET6.LADDR [ raddr=INET6.RADDR]]]\n\nTCP, TCPv6\nstate=SOCK.STATE[ laddr=TCP.LADDR [ raddr=TCP.RADDR]]\n\nUDP, UDPv6\nstate=SOCK.STATE[ laddr=UDP.LADDR [ raddr=UDP.RADDR]]\n\nlsfd hides raddr= if UDP.RADDR is 0.0.0.0 and UDP.RPORT is 0.\n\nUDP-LITE, UDPLITEv6\nstate=SOCK.STATE[ laddr=UDPLITE.LADDR [ raddr=UDPLITE.RADDR]]\n\nUNIX-STREAM\nstate=SOCK.STATE[ path=UNIX.PATH]\n\nUNIX\nstate=SOCK.STATE[ path=UNIX.PATH] type=SOCK.TYPE\n\nNETLINK.GROUPS >\nNetlink multicast groups.\n\nNETLINK.LPORT >\nNetlink local port id.\n\nNETLINK.PROTOCOL >\nNetlink protocol.\n\nNLINK \nLink count.\n\nNS.NAME \nName (NS.TYPE:[INODE]) of the namespace specified with the file.\n\nNS.TYPE \nType of the namespace specified with the file. The type is mnt, cgroup, uts, ipc, user,\npid, net, time, or unknown.\n\nOWNER \nOwner of the file.\n\nPACKET.IFACE \nInterface name associated with the packet socket.\n\nPACKET.PROTOCOL \nL3 protocol associated with the packet socket.\n\nPARTITION \nBlock device name resolved by /proc/partition.\n\nPID \nPID of the process opening the file.\n\nPIDFD.COMM \nCommand of the process targeted by the pidfd.\n\nPIDFD.NSPID \nValue of NSpid field in /proc/pid/fdinfo/fd of the pidfd.\n\nQuoted from kernel/fork.c of Linux source tree:\n\nIf pid namespaces are supported then this function will also print the pid of a\ngiven pidfd refers to for all descendant pid namespaces starting from the\ncurrent pid namespace of the instance, i.e. the Pid field and the first entry in\nthe NSpid field will be identical.\n\nNote that this differs from the Pid and NSpid fields in /proc//status where\nPid and NSpid are always shown relative to the pid namespace of the procfs\ninstance.\n\nPIDFD.PID \nPID of the process targeted by the pidfd.\n\nPING.ID <`number`>\nICMP echo request id used on the PING socket.\n\nPOS \nFile position.\n\nRAW.PROTOCOL \nProtocol number of the raw socket.\n\nRDEV \nDevice ID (if special file).\n\nSIZE \nFile size.\n\nSOCK.LISTENING \nListening socket.\n\nSOCK.NETS \nInode identifying network namespace where the socket belongs to.\n\nSOCK.PROTONAME \nProtocol name.\n\nSOCK.STATE \nState of socket.\n\nSOCK.TYPE \nType of socket. Here type means the second parameter of socket system call:\n\n• stream\n\n• dgram\n\n• raw\n\n• rdm\n\n• seqpacket\n\n• dccp\n\n• packet\n\nSOURCE \nFile system, partition, or device containing the file.\n\nSTTYPE \nRaw file types returned from stat(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN.\n\nTCP.LADDR \nLocal L3 (INET.LADDR or INET6.LADDR) address and local TCP port.\n\nTCP.LPORT \nLocal TCP port.\n\nTCP.RADDR \nRemote L3 (INET.RADDR or INET6.RADDR) address and remote TCP port.\n\nTCP.RPORT \nRemote TCP port.\n\nTID \nThread ID of the process opening the file.\n\nTYPE \nCooked version of STTYPE. It is same as STTYPE with exceptions. For SOCK, print the value\nfor SOCK.PROTONAME. For UNKN, print the value for AINODECLASS if SOURCE is anoninodefs.\n\nUDP.LADDR \nLocal IP address and local UDP port.\n\nUDP.LPORT \nLocal UDP port.\n\nUDP.RADDR \nRemote IP address and remote UDP port.\n\nUDP.RPORT \nRemote UDP port.\n\nUDPLITE.LADDR \nLocal IP address and local UDPLite port.\n\nUDPLITE.LPORT \nLocal UDP port.\n\nUDPLITE.RADDR \nRemote IP address and remote UDPLite port.\n\nUDPLITE.RPORT \nRemote UDP port.\n\nUID \nUser ID number.\n\nUNIX.PATH \nFilesystem pathname for UNIX domain socket.\n\nUSER \nUser of the process.\n", "subsections": [] }, "FILTER EXPRESSION": { "content": "lsfd evaluates the expression passed to --filter option every time before printing a file\nline. lsfd prints the line only if the result of evaluation is true.\n\nAn expression consists of column names, literals and, operators like: DELETED, (PID == 1),\n(NAME == \"/etc/passwd\"), (PID == 1) && DELETED. DELETED, PID, and NAME are column names in\nthe example. 1 and \"/etc/passwd\" are literals. == and && are operators.\n\nBefore evaluation, lsfd substitutes column names in the given expression with actual column\nvalues in the line. There are three different data types: boolean, string, and number. For\ncolumns with a boolean type, the value can be stand-alone. For string and number values, the\nvalue must be an operand of an operator, for example, (PID == 1). See OUTPUT COLUMNS about\nthe types of columns.\n\nLiteral is for representing a value directly. See BOOLLIT, STRLIT, and NUMLIT. Different data\ntypes have different literal syntax.\n\nAn operator works with one or two operand(s). An operator has an expectation about the data\ntype(s) of its operands. Giving an unexpected data type to an operator causes a syntax error.\n\nOperators taking two operands are and, or, eq, ne, le, lt, ge, gt, =~, !~. Alphabetically\nnamed operators have C-language flavored aliases: &&, ||, ==, !=, <, ⇐, >=, and >.\n\n! is the only operator that takes one operand.\n\neq, ne, and their aliases expect operands have the same data type. Applying these operators\nreturn a boolean.\n\nand, or, not and their aliases expect operands have boolean data type. Applying these\noperators return a boolean.\n\nlt, le, gt, ge, and their aliases expect operands have number data types. Applying these\noperators return a boolean.\n\n=~ is for regular expression matching; if a string at the right side matches a regular\nexpression at the left side, the result is true. The right side operand must be a string\nliteral. See STRLIT about the syntax.\n\n!~ is a short-hand version of not (STR =~ PAT); it inverts the result of =~.\n", "subsections": [ { "name": "Limitations", "content": "The current implementation does not define precedences within operators. Use ( and )\nexplicitly for grouping the sub-expressions if your expression uses more than two operators.\n\nAbout number typed values, the filter engine supports only non-negative integers.\n" }, { "name": "Semi-formal syntax", "content": "EXPR\nBOOLEXP\n\nBOOLEXP0\nCOLUMN | BOOLLIT | ( BOOLEXP )\n\nBOOLEXP\nBOOLEXP0 | BOOLOP1 | BOOLOP2 | BOOLOP2BL | BOOLOP2CMP | BOOLOP2REG\n\nCOLUMN\n[A-Za-z][-:A-Za-z0-9]*\n\nBOOLOP1\n! BOOLEXP0 | not BOOLEXP0\n\nSTREXP\nCOLUMN | STRLIT\n\nNUMEXP\nCOLUMN | NUMLIT\n\nBOOLLIT\ntrue | false\n\nCHARS\n( [^\\] | \\\\ | \\' | \\\" )*\n\nSTRLIT\n' CHARS ' | \" CHARS \"\n\nNUMLIT\n[1-9][0-9]* | 0\n\nBOOLOP2\nSTREXP OP2 STREXP | NUMEXP OP2 NUMEXP | BOOLEXP0 OP2 BOOLEXP0\n\nOP2\n== | eq | != | ne\n\nBOOLOP2BL\nBOOLEXP0 OP2BL BOOLEXP0\n\nOP2BL\n&& | and | || | or\n\nBOOLOP2CMP\nNUMEXP OP2CMP NUMEXP\n\nOP2CMP\n< | lt | <= | le | > | gt | >= | ge\n\nBOOLOP2REG\nSTREXP OP2REG STRLIT\n\nOP2REG\n=~ | !~\n" } ] }, "FILTER EXAMPLES": { "content": "lsfd has few options for filtering. In most of cases, what you should know is -Q (or\n--filter) option. Combined with -o (or --output) option, you can customize the output as you\nwant.\n\nList files associated with PID 1 and PID 2 processes:\n\n# lsfd -Q '(PID == 1) or (PID == 2)'\n\nDo the same in an alternative way:\n\n# lsfd -Q '(PID == 1) || (PID == 2)'\n\nDo the same in a more efficient way:\n\n# lsfd --pid 1,2\n\nWhitescapes can be used instead of a comma:\n\n# lsfd --pid '1 2'\n\nUtilize pidof(1) for list the files associated with \"firefox\":\n\n# lsfd --pid \"$(pidof firefox)\"\n\nList the 1st file descriptor opened by PID 1 process:\n\n# lsfd -Q '(PID == 1) and (FD == 1)'\n\nDo the same in an alternative way:\n\n# lsfd -Q '(PID == 1) && (FD == 1)'\n\nList all running executables:\n\n# lsfd -Q 'ASSOC == \"exe\"'\n\nDo the same in an alternative way:\n\n# lsfd -Q 'ASSOC eq \"exe\"'\n\nDo the same but print only file names:\n\n# lsfd -o NAME -Q 'ASSOC eq \"exe\"' | sort -u\n\nList deleted files associated to processes:\n\n# lsfd -Q 'DELETED'\n\nList non-regular files:\n\n# lsfd -Q 'TYPE != \"REG\"'\n\nList block devices:\n\n# lsfd -Q 'DEVTYPE == \"blk\"'\n\nDo the same with TYPE column:\n\n# lsfd -Q 'TYPE == \"BLK\"'\n\nList files including \"dconf\" directory in their names:\n\n# lsfd -Q 'NAME =~ \".\\*/dconf/.*\"'\n\nList files opened in a QEMU virtual machine:\n\n# lsfd -Q '(COMMAND =~ \".\\*qemu.*\") and (FD >= 0)'\n\nHide files associated to kernel threads:\n\n# lsfd -Q '!KTHREAD'\n", "subsections": [] }, "COUNTER EXAMPLES": { "content": "Report the numbers of netlink socket descriptors and unix socket descriptors:\n\n# lsfd --summary=only \\\n-C 'netlink sockets':'(NAME =~ \"NETLINK:.*\")' \\\n-C 'unix sockets':'(NAME =~ \"UNIX:.*\")'\nVALUE COUNTER\n57 netlink sockets\n1552 unix sockets\n\nDo the same but print in JSON format:\n\n# lsfd --summary=only --json \\\n-C 'netlink sockets':'(NAME =~ \"NETLINK:.*\")' \\\n-C 'unix sockets':'(NAME =~ \"UNIX:.*\")'\n{\n\"lsfd-summary\": [\n{\n\"value\": 15,\n\"counter\": \"netlink sockets\"\n},{\n\"value\": 798,\n\"counter\": \"unix sockets\"\n}\n]\n}\n", "subsections": [] }, "HISTORY": { "content": "The lsfd command is part of the util-linux package since v2.38.\n", "subsections": [] }, "AUTHORS": { "content": "\u001b[34mMasatake YAMATO \u001b[0m, \u001b[34mKarel Zak \u001b[0m\n", "subsections": [] }, "SEE ALSO": { "content": "lsof(8) pidof(1) proc(5) socket(2) stat(2)\n", "subsections": [] }, "REPORTING BUGS": { "content": "For bug reports, use the issue tracker at \u001b[34mhttps://github.com/util-linux/util-linux/issues\u001b[0m.\n", "subsections": [] }, "AVAILABILITY": { "content": "The lsfd command is part of the util-linux package which can be downloaded from \u001b[34mLinux Kernel\u001b[0m\n\u001b[34mArchive \u001b[0m.\n\nutil-linux 2.39.3 2023-12-01 LSFD(1)", "subsections": [] } } } }