# Improvements to sysutils/lsof



## grahamperrin@ (Dec 18, 2021)

sysutils/lsof

Background



Alain De Vos said:


> lsof does not show anything.



– and so on.


Now

Good news. Significant improvements ahead:









						Use user mode APIs on FreeBSD by DamjanJovanovic · Pull Request #184 · lsof-org/lsof
					

This patchset gets lsof to mainly use user mode APIs on FreeBSD. Kernel access with kvm is now optional although still required for a few features. Many other bugs are fixed in the process, the cod...




					github.com
				




Related FreeBSD bugs include:

253553 – sysutils/lsof: no zfs support on 13
260235 – sysutils/lsof: filenames missing on FreeBSD >= 13, due to namecache field change
…


----------



## grahamperrin@ (Dec 19, 2021)

Additional context


<https://lists.freebsd.org/archives/freebsd-hackers/2021-November/000436.html> (quote below)
<https://wiki.freebsd.org/2021FoundationCFI#Other> ◀ <https://forums.freebsd.org/posts/545955> under *Call for Foundation-supported Project Ideas*



> Can I PLEASE get some help on sysutils/lsof (which has been broken for all of 13 and 14's lifetime)?
> 
> If I can't, I'm going to rmport it.


----------



## mack3457 (Jan 25, 2022)

As lsof on freebsd 13 doesn't work (on zfs), is there any alternative, I may use?


----------



## SirDice (Jan 25, 2022)

mack3457 said:


> As lsof on freebsd 13 doesn't work (on zfs), is there any alternative, I may use?


fstat(1)?


----------



## mack3457 (Jan 25, 2022)

Thanks, I'll have a look into it.


----------



## covacat (Jan 25, 2022)

procstat -af |grep /path/to/file


----------



## Alain De Vos (Jan 25, 2022)

SirDice said:


> fstat(1)?


This one is interesting,

```
fstat | awk 'NR > 1 {print    $2;}' |    sort | uniq -c | sort -r
```


----------



## grahamperrin@ (Jan 25, 2022)

Alain De Vos said:


> This one is interesting,



I ran it. What does it mean?


----------



## grahamperrin@ (Jan 25, 2022)

covacat said:


> procstat -af |grep /path/to/file




```
root@mowa219-gjp4-8570p-freebsd:~ # mount | grep Transcend
Transcend on /Volumes/t500 (zfs, local, nfsv4acls)
Transcend/VirtualBox on /Volumes/t500/VirtualBox (zfs, local, nfsv4acls)
root@mowa219-gjp4-8570p-freebsd:~ # procstat -af |grep /Volumes/t500/VirtualBox
procstat: kinfo_getfile(): No such process
root@mowa219-gjp4-8570p-freebsd:~ # lsof /Volumes/t500/VirtualBox
lsof: WARNING: device cache mismatch: /dev/drm/74
lsof: WARNING: no ZFS support has been defined.
      See 00FAQ for more information.
lsof: WARNING: /root/.lsof_mowa219-gjp4-8570p-freebsd was updated.
root@mowa219-gjp4-8570p-freebsd:~ #
```


----------



## grahamperrin@ (Jan 25, 2022)

mack3457 said:


> As lsof on freebsd 13 doesn't work (on zfs), is there any alternative, I may use?



Try <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=253553#c13>.


----------



## grahamperrin@ (Jan 25, 2022)

SirDice said:


> fstat(1)?



"… Normally the name cannot be determined …"

So, a list of inode numbers, not a list of names.

Based on Quickly find which file(s) belongs to a specific inode number - Unix & Linux Stack Exchange (the question, not the answer): 


```
root@mowa219-gjp4-8570p-freebsd:~ # fstat -f /Volumes/t500/VirtualBox/
USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
grahampe VirtualBoxVM 34245   36 /Volumes/t500/VirtualBox    422 -rw-------  36710645760 rw
grahampe VirtualBoxVM 34245   37 /Volumes/t500/VirtualBox     49 -rw-------   77262  w
grahampe VirtualBoxVM 34245   39 /Volumes/t500/VirtualBox     53 -rw-------  1037041664  r
root@mowa219-gjp4-8570p-freebsd:~ # find /Volumes/t500/VirtualBox -inum 49
/Volumes/t500/VirtualBox/BSD/FreeBSD/FreeBSD 13-STABLE/Logs/VBox.log
root@mowa219-gjp4-8570p-freebsd:~ # find /Volumes/t500/VirtualBox -inum 53
/Volumes/t500/VirtualBox/BSD/FreeBSD/FreeBSD 13-STABLE/FreeBSD 13-STABLE.vdi
root@mowa219-gjp4-8570p-freebsd:~ # find /Volumes/t500/VirtualBox -inum 422
/Volumes/t500/VirtualBox/BSD/FreeBSD/FreeBSD 13-STABLE/Snapshots/{abd46eb0-cc97-4524-8094-ec3199417372}.vdi
root@mowa219-gjp4-8570p-freebsd:~ #
```


----------



## grahamperrin@ (Jan 26, 2022)

ZFS aside, for a moment.

From Mac OS X, I'm accustomed to `lsof` alone resulting in a list of files that includes the *path* to each *named file*. For example, from <https://apple.stackexchange.com/a/104850/8546>


```
COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
mds         89  root   19r   DIR   52,3      432     2 /Volumes/Photos
mds         89  root   23r   DIR   52,3      432     2 /Volumes/Photos
Finder     681 alans   14r   DIR   52,3      432     2 /Volumes/Photos
QuickLook 2158 alans    9r   REG   52,3  1141591 78651 /Volumes/Photos/_tmp_iphone_10_backup/APC_1546.JPG
```


lsof(8) for FreeBSD

Below, there's the inode number for a file on a UFS file system. From the manual page, I can't tell how to get the path and filename.


```
root@mowa219-gjp4-8570p-freebsd:~ # lsof /media/Verbatim_STORE_N_GO_07B7050762213D03_s2_s2a
lsof: WARNING: no ZFS support has been defined.
      See 00FAQ for more information.
COMMAND   PID         USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
code-oss 4172 grahamperrin  122r  VREG    2,8        0 12297 /media/Verbatim_STORE_N_GO_07B7050762213D03_s2_s2a (/dev/da3s2a)
root@mowa219-gjp4-8570p-freebsd:~ #
```


----------



## grahamperrin@ (Jan 26, 2022)

grahamperrin said:


> … Mac OS X, I'm accustomed to `lsof` alone resulting in a list of files that includes the *path* to each *named file*. …





> … the inode number for a file on a UFS file system. From the manual page, I can't tell how to get the path and filename. …



Largely fixed – tested with OpenZFS and UFS – but not yet in the ports collection:


```
root@mowa219-gjp4-8570p-freebsd:~ # lsof /Volumes/t500/VirtualBox/
lsof: WARNING -- reading xvnode list failed: No such file or directory
COMMAND     PID         USER   FD   TYPE                DEVICE   SIZE/OFF NODE NAME
VirtualBo 56066 grahamperrin   36w  VREG 3567975594,2089344763      70041  222 /Volumes/t500/VirtualBox/BSD/others/OpenBSD/Logs/VBox.log (Transcend/VirtualBox)
VirtualBo 56066 grahamperrin   39r  VREG 3567975594,2089344763 2379218944  158 /Volumes/t500/VirtualBox/BSD/others/OpenBSD/OpenBSD.vdi (Transcend/VirtualBox)
VirtualBo 56066 grahamperrin   43u  VREG 3567975594,2089344763  312475648  328 /Volumes/t500/VirtualBox/BSD/others/OpenBSD/Snapshots/{66c19c3c-ec01-4d02-99b9-8be9d9090666}.vdi (Transcend/VirtualBox)
VirtualBo 56066 grahamperrin   46r  VREG 3567975594,2089344763  621858951  448 /Volumes/t500/VirtualBox/BSD/others/OpenBSD/Snapshots/2022-01-24T07-36-01-348375000Z.sav (Transcend/VirtualBox)
root@mowa219-gjp4-8570p-freebsd:~ # mount | grep ufs
/dev/da3s2a on /media/Verbatim_STORE_N_GO_07B7050762213D03_s2_s2a (ufs, local)
root@mowa219-gjp4-8570p-freebsd:~ # lsof /media/Verbatim_STORE_N_GO_07B7050762213D03_s2_s2a
lsof: WARNING -- reading xvnode list failed: No such file or directory
COMMAND   PID         USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
code-oss 4172 grahamperrin  106r  VREG    2,8        0 12297 /media/Verbatim_STORE_N_GO_07B7050762213D03_s2_s2a/tmp/touched.txt (/dev/da3s2a)
root@mowa219-gjp4-8570p-freebsd:~ #
```


----------



## mack3457 (Jan 26, 2022)

Ok, so fstat and procstat need to be run as root (or the requested user), to list files other than own files.

I will have a look at the new port file for lsof.


----------



## grahamperrin@ (Jan 26, 2022)

mack3457 said:


> … list files other than own files. …



From <https://github.com/lsof-org/lsof/pull/184#issue-1083848457>: 



> … lsof is now able to run as an ordinary user, but won't necessarily see all processes and files in that case. …


----------

