lsof-org
Why lsof scan the whole filesystem
I mount sdc to /mnt/sdc which is btrfs filesystem with subvolume,
When umount, it's busy, so I use the command lsof -x f +D /mnt/sdc to inspect which program using sdc.
But lsof command hang for too long, it scan the whole /mnt/sdc filesystem which has millions of files. As my knowledge, lsof just need scan /proc/*/fd, to filter paths that belong to /mnt/sdc, why scan the filesystem ?
is there any option to do this?
But lsof command hang for too long, it scan the whole /mnt/sdc filesystem which has millions of files. As my knowledge, lsof just need scan /proc/*/fd, to filter paths that belong to /mnt/sdc, why scan the filesystem ?
Can you provide a strace?
mount tmpfs and create 3 directories.
$ mkdir /mnt/tmp
$ mount -t tmpfs none /mnt/tmp
$ mkdir -p /mnt/tmp/a/b/c
lsof will scan tmpfs before scan procfs
$ strace -e openat lsof -x f +D /mnt/tmp 2>&1 >/dev/null | head -n 20
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/dev/null", O_RDWR) = 3
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/proc/mounts", O_RDONLY) = 3
openat(AT_FDCWD, "/mnt/tmp", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/mnt/tmp/a", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/mnt/tmp/a/b", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/mnt/tmp/a/b/c", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/", O_RDONLY) = 3
openat(AT_FDCWD, "/proc/141363/fdinfo/3", O_RDONLY) = 6
openat(AT_FDCWD, "/proc/locks", O_RDONLY) = 3
openat(AT_FDCWD, "/proc", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/proc/1/stat", O_RDONLY) = 6
openat(AT_FDCWD, "/proc/1/maps", O_RDONLY) = 6
openat(AT_FDCWD, "/proc/1/fd", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 6
openat(AT_FDCWD, "/proc/1/fdinfo/0", O_RDONLY) = 7
openat(AT_FDCWD, "/proc/1/fdinfo/1", O_RDONLY) = 7
openat(AT_FDCWD, "/proc/1/fdinfo/2", O_RDONLY) = 7
openat(AT_FDCWD, "/proc/1/fdinfo/3", O_RDONLY) = 7
seems I should use
+dinsted of+D
yes, scanning the disk is intended if you specify +D.
+d s causes lsof to search for all open instances of directory s and the files and directories it contains at its top
level. +d does NOT descend the directory tree, rooted at s. The +D D option may be used to request a full-descent
directory tree search, rooted at directory D.
Processing of the +d option does not follow symbolic links within s unless the -x or -x l option is also specified.
Nor does it search for open files on file system mount points on subdirectories of s unless the -x or -x f option
is also specified.
Note: the authority of the user of this option limits it to searching for files that the user has permission to ex‐
amine with the system stat(2) function.
+D D causes lsof to search for all open instances of directory D and all the files and directories it contains to its
complete depth.
Processing of the +D option does not follow symbolic links within D unless the -x or -x l option is also specified.
Nor does it search for open files on file system mount points on subdirectories of D unless the -x or -x f option
is also specified.
Note: the authority of the user of this option limits it to searching for files that the user has permission to ex‐
amine with the system stat(2) function.
Further note: lsof may process this option slowly and require a large amount of dynamic memory to do it. This is
because it must descend the entire directory tree, rooted at D, calling stat(2) for each file and directory, build‐
ing a list of all the files it finds, and searching that list for a match with every open file. When directory D is
large, these steps can take a long time, so use this option prudently.
top level vs recursive.