Home / lsof does not list as many files with -p as when used with grep and awk

lsof does not list as many files with -p as when used with grep and awk

Only files opened by the specified PID are listed using the lsof command with the -p option.
The -p option entirely ignores files generated by a thread with a TID. When we grep for a specific PID, it lists all the lines where the PID is located while considering the files opened by a thread.

The files created by a thread are listed with all files opened with a PID equal to the supplied PID when awk is used in conjunction with the lsof command. This explains why using the lsof -p command results in fewer processes.

List files on a CentOS Linux server using the -p option and the lsof command as below.

# lsof -p 1530 | wc -l
238

On the same machine, grep/awk yields the results below.

# lsof | grep -i 1530 | wc -l
2180
# lsof | awk '$2 == 1530'|wc -l
213

In the output of the lsof -p command, we do not observe a TID column, as shown below.

# lsof -p 1530 | head -3
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sublime_t 1530 test cwd DIR 253,1 4096 2 /
sublime_t 1530 test rtd DIR 253,1 4096 2 /

Leave a Reply