how to check open file without lsof

How to Check Open Files Without lsof

The lsof command is a powerful tool for listing open files, but what if you don’t have it available? There are other methods you can use to check open files on Unix-like systems.

Using the /proc Filesystem

Understanding /proc

The /proc filesystem is a virtual filesystem that provides information about running processes. Each process has its own directory within /proc, and this directory contains files that reveal details about the process, including its open files.

Checking Open Files

Here’s how to check open files using the /proc filesystem:

1. Find the Process ID (PID): You can use the ps command to find the PID of the process you’re interested in. For example, to find the PID of the process running the bash shell:

ps aux | grep bash

user    2973  0.0  0.0 112480  3120  pts/0    S+   10:05   0:00 bash

2. Navigate to the Process Directory: Go to the /proc directory and then the directory corresponding to the process’s PID.

cd /proc/2973

3. Examine the fd Directory: The fd directory contains files representing the process’s open file descriptors. Each file name is a numerical descriptor, and its contents will typically reveal the path to the file it’s referring to.

ls fd/

0  1  2  3  255

4. Inspect Individual File Descriptors: You can examine the contents of specific file descriptors using the cat command. For example, to see the file associated with descriptor 3:

cat fd/3

/dev/pts/0

Example

Here’s an example of checking open files for the process with PID 2973:

cd /proc/2973
ls fd/
cat fd/3

This will list the open file descriptors for the process and then display the path to the file associated with file descriptor 3.

Using the strace Command

The strace command can be used to trace system calls made by a process. It can be helpful for identifying file operations, such as opening and closing files.

Basic Usage

To use strace to check open files, you can run it on the process you’re interested in. This will trace all system calls made by the process, including those related to file operations.

strace -p 2973

Filtering Output

The output from strace can be quite verbose. You can filter the output to focus on file-related calls using the -e flag with options like open, read, write, and close.

strace -p 2973 -e open

strace -p 2973 -e trace=open,read,write,close

Example

Here’s an example of using strace to trace the open system calls made by a process with PID 2973:

strace -p 2973 -e open

The output will show any calls to open made by the process, including the file paths that are opened.

Other Methods

• System Utilities: Some operating systems may offer dedicated utilities for checking open files. For example, on macOS, the lsof command is typically available.
• Debug Tools: Debuggers like gdb can be used to inspect the process memory and identify open file descriptors.
• Process Monitoring Tools: Monitoring tools like htop or top might display information about open files in their process listings.

Comparison

Conclusion

While lsof is a very helpful tool, understanding how to check open files using the /proc filesystem and strace provides valuable knowledge for system administrators and developers. Choosing the appropriate method depends on the specific situation, desired level of detail, and available tools.