misc-utils/lsfd.1.adoc

   1 //po4a: entry man manual
   2 ////
   3 Copyright 2021 Red Hat, Inc.
   4
   5 This file may be copied under the terms of the GNU Public License.
   6 ////
   7 = lsfd(1)
   8 :doctype: manpage
   9 :man manual: User Commands
  10 :man source: util-linux {release-version}
  11 :page-layout: base
  12 :command: lsfd
  13 :colon: :
  14
  15 == NAME
  16
  17 lsfd - list file descriptors
  18
  19 == SYNOPSIS
  20
  21 *lsfd* [option]
  22
  23 == DESCRIPTION
  24
  25 *lsfd* is intended to be a modern replacement for *lsof*(8) on Linux systems.
  26 Unlike *lsof*, *lsfd* is specialized to Linux kernel; it supports Linux
  27 specific features like namespaces with simpler code. *lsfd* is not a
  28 drop-in replacement for *lsof*; they are different in the command line
  29 interface and output formats.
  30
  31 The default output is subject to change. So whenever possible, you should avoid using
  32 default outputs in your scripts. Always explicitly define expected columns by using
  33 *--output* _columns-list_ in environments where a stable output is required.
  34
  35 *lsfd* uses Libsmartcols for output formatting and filtering. See the description of *--output*
  36 option for customizing the output format, and *--filter* option for filtering. Use *lsfd --help*
  37 to get a list of all available columns.
  38
  39 == OPTIONS
  40
  41 *-l*, *--threads*::
  42 List in threads level.
  43
  44 *-J*, *--json*::
  45 Use JSON output format.
  46
  47 *-n*, *--noheadings*::
  48 Don't print headings.
  49
  50 *-o*, *--output* _list_::
  51 Specify which output columns to print. See the *OUTPUT COLUMNS*
  52 section for details of available columns.
  53 +
  54 The default list of columns may be extended if _list_ is specified in
  55 the format +_list_ (e.g., *lsfd -o +DELETED*).
  56
  57 *-r*, *--raw*::
  58 Use raw output format.
  59
  60 *--notruncate*::
  61 Don't truncate text in columns.
  62
  63 *-p*, *--pid* _pids_::
  64 Collect information only for specified processes.
  65 _pids_ is a list of pids. A comma or whitespaces can be used as separators.
  66 You can use this option with *pidof*(1). See *FILTER EXAMPLES*.
  67 +
  68 Both *-Q* option with an expression including PID, e.g. -Q (PID == 1),
  69 and *-p* option, e.g. -p 1, may print the same output but using *-p*
  70 option is much more efficient because *-p* option works at a much earlier
  71 stage of processing than the *-Q* option.
  72
  73 *-i*[4|6], *--inet*[=4|=6]::
  74 List only IPv4 sockets and/or IPv6 sockets.
  75
  76 *-Q*, *--filter* _expr_::
  77 Print only the files matching the condition represented by the _expr_.
  78 See also *FILTER EXAMPLES*.
  79
  80 *-C*, *--counter* __label__:__filter_expr__::
  81 Define a custom counter used in *--summary* output. *lsfd* makes a
  82 counter named _label_. During collect information, *lsfd* counts files
  83 matching _filter_expr_, and stores the counted number to the
  84 counter named _label_. *lsfd* applies filters defined with *--filter*
  85 options before counting; files excluded by the filters are not counted.
  86 +
  87 See *FILTER EXPRESSION* about _filter_expr_.
  88 _label_ should not include `{` nor `:`. You can define multiple
  89 counters by specifying this option multiple times.
  90 +
  91 See also *COUNTER EXAMPLES*.
  92
  93 *--summary*[=_when_]::
  94 This option controls summary lines output. The optional argument _when_
  95 can be *only*, *append* or *never*. If the _when_ argument is omitted,
  96 it defaults to *only*.
  97 +
  98 The summary reports counters. A counter consists of a label and an
  99 integer value.  *--counter* is the option for defining a counter.  If
 100 a user defines no counter, *lsfd* uses the definitions of pre-defined
 101 built-in counters (default counters) to make the summary output.
 102 +
 103 CAUTION{colon} Using *--summary* and *--json* may make the output broken. Only combining *--summary*=*only* and *--json* is valid.
 104 //TRANSLATORS: Keep {colon} untranslated.
 105
 106 *--debug-filter*::
 107 Dump the internal data structure for the filter and exit. This is useful
 108 only for *lsfd* developers.
 109
 110 *--dump-counters*::
 111 Dump the definition of counters used in *--summary* output.
 112
 113 *-H*, *--list-columns*::
 114 List available columns that you can specify at *--output* option.
 115
 116 include::man-common/help-version.adoc[]
 117
 118 == OUTPUT COLUMNS
 119
 120 Each column has a type. Types are surround by < and >.
 121
 122 //TRANSLATORS: Keep {colon} untranslated.
 123 CAUTION{colon} The names and types of columns are not stable yet.
 124 They may be changed in the future releases.
 125
 126 AINODECLASS <``string``>::
 127 Class of anonymous inode.
 128
 129 ASSOC <``string``>::
 130 Association between file and process.
 131
 132 BLKDRV <``string``>::
 133 Block device driver name resolved by `/proc/devices`.
 134
 135 BPF-PROG.ID <``number``>::
 136 Bpf program ID.
 137
 138 BPF-PROG.TYPE <``string``>::
 139 Decoded name of bpf program type.
 140
 141 BPF-PROG.TYPE.RAW <``number``>::
 142 Bpf program type (raw).
 143
 144 CHRDRV <``string``>::
 145 Character device driver name resolved by `/proc/devices`.
 146
 147 COMMAND <``string``>::
 148 Command of the process opening the file.
 149
 150 DELETED <``boolean``>::
 151 Reachability from the file system.
 152
 153 DEV <``string``>::
 154 ID of the device containing the file.
 155
 156 DEVTYPE <``string``>::
 157 Device type (`blk`, `char`, or `nodev`).
 158
 159 ENDPOINT <``string``>::
 160 IPC endpoints information communicated with the fd.
 161 +
 162 *lsfd* collects endpoints within the processes that
 163 *lsfd* scans; *lsfd* may miss some endpoints
 164 if you limits the processes with *-p* option.
 165 +
 166 The format of the column depends on the object associated
 167 with the fd:
 168
 169 FIFO type:::
 170 mqueue type:::
 171 _PID_,_COMMAND_,_ASSOC_[-r][-w]
 172 +
 173 The last characters ([-r][-w]) represents the read and/or
 174 write mode of the endpoint.
 175
 176 eventfd type:::
 177 _PID_,_COMMAND_,_ASSOC_
 178
 179 EVENTFD.ID <``number``>::
 180 Eventfd ID.
 181
 182 EVENTPOLL.TFDS <``string``>::
 183 File descriptors targeted by the eventpoll file.
 184
 185 FD <``number``>::
 186 File descriptor for the file.
 187
 188 FLAGS <``string``>::
 189 Flags specified when opening the file.
 190
 191 FUID <``number``>::
 192 User ID number of the file's owner.
 193
 194 INET.LADDR <``string``>::
 195 Local IP address.
 196
 197 INET.RADDR <``string``>::
 198 Remote IP address.
 199
 200 INET6.LADDR <``string``>::
 201 Local IP6 address.
 202
 203 INET6.RADDR <``string``>::
 204 Remote IP6 address.
 205
 206 INODE <``number``>::
 207 Inode number.
 208
 209 INOTIFY.INODES <``string``>::
 210 Cooked version of INOTIFY.INODES.RAW.
 211 The format of the element is
 212 _inode-number_,_source-of-inode_.
 213
 214 INOTIFY.INODES.RAW <``string``>::
 215 List of monitoring inodes. The format of the element
 216 is _inode-number_,_device-major_:_device-minor_.
 217
 218 KNAME <``string``>::
 219 //
 220 // It seems that the manpage backend of asciidoctor has limitations
 221 // about emitting text with nested face specifications like:
 222 //
 223 //   `_u_` p
 224 //
 225 // Not only u but also p is decorated with underline.
 226 //
 227 Raw file name extracted from
 228 from ``/proc/``_pid_``/fd/``_fd_ or ``/proc/``_pid_``/map_files/``_region_.
 229
 230 KTHREAD <``boolean``>::
 231 Whether the process is a kernel thread or not.
 232
 233 MAJ:MIN <``string``>::
 234 Device ID for special, or ID of device containing file.
 235
 236 MAPLEN <``number``>::
 237 Length of file mapping (in page).
 238
 239 MISCDEV <``string``>::
 240 Misc character device name resolved by `/proc/misc`.
 241
 242 MNTID <``number``>::
 243 Mount ID.
 244
 245 MODE <``string``>::
 246 Access mode (rwx).
 247
 248 NAME <``string``>::
 249 Cooked version of KNAME. It is mostly same as KNAME.
 250 +
 251 Some files have special formats and information sources:
 252 +
 253 bpf-prog:::
 254 id=_BPF-PROG.ID_ type=_BPF-PROG.TYPE_
 255 +
 256 eventpoll:::
 257 tfds=_EVENTPOLL.TFDS_
 258 +
 259 eventfd:::
 260 id=_EVENTFD.ID_
 261 +
 262 inotify:::
 263 inodes=_INOTIFY.INODES_
 264 +
 265 misc:tun:::
 266 iface=_TUN.IFACE_
 267 +
 268 NETLINK:::
 269 protocol=_NETLINK.PROTOCOL_[ lport=_NETLINK.LPORT_[ group=_NETLINK.GROUPS_]]
 270 +
 271 PACKET:::
 272 type=_SOCK.TYPE_[ protocol=_PACKET.PROTOCOL_][ iface=_PACKET.IFACE_]
 273 +
 274 pidfd:::
 275 pid=_TARGET-PID_ comm=_TARGET-COMMAND_ nspid=_TARGET-NSPIDS_
 276 +
 277 *lsfd* extracts _TARGET-PID_ and _TARGET-NSPIDS_ from
 278 ``/proc/``_pid_``/fdinfo/``_fd_.
 279 +
 280 PING:::
 281 state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]
 282 +
 283 PINGv6:::
 284 state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]
 285 +
 286 RAW:::
 287 state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]]
 288 +
 289 RAWv6:::
 290 state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]]
 291 +
 292 signalfd:::
 293 mask=_SIGNALFD.MASK_
 294 +
 295 TCP:::
 296 TCPv6:::
 297 state=_SOCK.STATE_[ laddr=_TCP.LADDR_ [ raddr=_TCP.RADDR_]]
 298 +
 299 timerfd:::
 300 clockid=_TIMERFD.CLOCKID_[ remaining=_TIMERFD.REMAINING_ [ interval=_TIMERFD.INTERVAL_]]
 301 +
 302 UDP:::
 303 UDPv6:::
 304 state=_SOCK.STATE_[ laddr=_UDP.LADDR_ [ raddr=_UDP.RADDR_]]
 305 +
 306 *lsfd* hides ``raddr=`` if _UDP.RADDR_ is ``0.0.0.0`` and _UDP.RPORT_ is 0.
 307 +
 308 UDP-LITE:::
 309 UDPLITEv6:::
 310 state=_SOCK.STATE_[ laddr=_UDPLITE.LADDR_ [ raddr=_UDPLITE.RADDR_]]
 311 +
 312 UNIX-STREAM:::
 313 state=_SOCK.STATE_[ path=_UNIX.PATH_]
 314 +
 315 UNIX:::
 316 state=_SOCK.STATE_[ path=_UNIX.PATH_] type=_SOCK.TYPE_
 317
 318 ____
 319 Note that `(deleted)` markers are removed from this column.
 320 Refer to _KNAME_, _DELETED_, or _XMODE_ to know the
 321 readability of the file from the file system.
 322 ____
 323
 324 NETLINK.GROUPS <``number``>::
 325 Netlink multicast groups.
 326
 327 NETLINK.LPORT <``number``>::
 328 Netlink local port id.
 329
 330 NETLINK.PROTOCOL <``string``>::
 331 Netlink protocol.
 332
 333 NLINK <``number``>::
 334 Link count.
 335
 336 NS.NAME <``string``>::
 337 Name (_NS.TYPE_:[_INODE_]) of the namespace specified with the file.
 338
 339 NS.TYPE <``string``>::
 340 Type of the namespace specified with the file.
 341 The type is `mnt`, `cgroup`, `uts`, `ipc`, `user`, `pid`, `net`,
 342 `time`, or `unknown`.
 343
 344 OWNER <``string``>::
 345 Owner of the file.
 346
 347 PACKET.IFACE <``string``>::
 348 Interface name associated with the packet socket.
 349
 350 PACKET.PROTOCOL <``string``>::
 351 L3 protocol associated with the packet socket.
 352
 353 PARTITION <``string``>::
 354 Block device name resolved by `/proc/partition`.
 355
 356 PID <``number``>::
 357 PID of the process opening the file.
 358
 359 PIDFD.COMM <``string``>::
 360 Command of the process targeted by the pidfd.
 361
 362 PIDFD.NSPID <``string``>::
 363 Value of NSpid field in ``/proc/``_pid_``/fdinfo/``_fd_ of the pidfd.
 364 +
 365 Quoted from kernel/fork.c of Linux source tree:
 366 +
 367 ____
 368 If pid namespaces are supported then this function will also print
 369 the pid of a given pidfd refers to for all descendant pid namespaces
 370 starting from the current pid namespace of the instance, i.e. the
 371 Pid field and the first entry in the NSpid field will be identical.
 372
 373 Note that this differs from the Pid and NSpid fields in
 374 /proc/<pid>/status where Pid and NSpid are always shown relative to
 375 the pid namespace of the procfs instance.
 376 ____
 377
 378 PIDFD.PID <``number``>::
 379 PID of the process targeted by the pidfd.
 380
 381 PING.ID <`number`>::
 382 ICMP echo request id used on the PING socket.
 383
 384 POS <``number``>::
 385 File position.
 386
 387 RAW.PROTOCOL <``number``>::
 388 Protocol number of the raw socket.
 389
 390 RDEV <``string``>::
 391 Device ID (if special file).
 392
 393 SIGNALFD.MASK <``string``>::
 394 Masked signals.
 395
 396 SIZE <``number``>::
 397 File size.
 398
 399 SOCK.LISTENING <``boolean``>::
 400 Listening socket.
 401
 402 SOCK.NETS <``number``>::
 403 Inode identifying network namespace where the socket belongs to.
 404
 405 SOCK.PROTONAME <``string``>::
 406 Protocol name.
 407
 408 SOCK.STATE <``string``>::
 409 State of socket.
 410
 411 SOCK.TYPE <``string``>::
 412 Type of socket. Here type means the second parameter of
 413 socket system call:
 414 +
 415 * stream
 416 * dgram
 417 * raw
 418 * rdm
 419 * seqpacket
 420 * dccp
 421 * packet
 422
 423 SOURCE <``string``>::
 424 File system, partition, or device containing the file.
 425
 426 STTYPE <``string``>::
 427 Raw file types returned from *stat*(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN.
 428
 429 TCP.LADDR <``string``>::
 430 Local L3 (INET.LADDR or INET6.LADDR) address and local TCP port.
 431
 432 TCP.LPORT <``number``>::
 433 Local TCP port.
 434
 435 TCP.RADDR <``string``>::
 436 Remote L3 (INET.RADDR or INET6.RADDR) address and remote TCP port.
 437
 438 TCP.RPORT <``number``>::
 439 Remote TCP port.
 440
 441 TID <``number``>::
 442 Thread ID of the process opening the file.
 443
 444 TIMERFD.CLOCKID <``string``>::
 445 Clockid.
 446
 447 TIMERFD.INTERVAL <``number``>::
 448 Interval.
 449
 450 TIMERFD.REMAINING <``number``>::
 451 Remaining time.
 452
 453 TUN.IFACE <``string``>::
 454 Network intrface behind the tun device.
 455
 456 TYPE <``string``>::
 457 Cooked version of STTYPE. It is same as STTYPE with exceptions.
 458 For SOCK, print the value for SOCK.PROTONAME.
 459 For UNKN, print the value for AINODECLASS if SOURCE is anon_inodefs.
 460
 461 UDP.LADDR <``string``>::
 462 Local IP address and local UDP port.
 463
 464 UDP.LPORT <``number``>::
 465 Local UDP port.
 466
 467 UDP.RADDR <``string``>::
 468 Remote IP address and remote UDP port.
 469
 470 UDP.RPORT <``number``>::
 471 Remote UDP port.
 472
 473 UDPLITE.LADDR <``string``>::
 474 Local IP address and local UDPLite port.
 475
 476 UDPLITE.LPORT <``number``>::
 477 Local UDP port.
 478
 479 UDPLITE.RADDR <``string``>::
 480 Remote IP address and remote UDPLite port.
 481
 482 UDPLITE.RPORT <``number``>::
 483 Remote UDP port.
 484
 485 UID <``number``>::
 486 User ID number.
 487
 488 UNIX.PATH <``string``>::
 489 Filesystem pathname for UNIX domain socket.
 490
 491 USER <``string``>::
 492 User of the process.
 493
 494 XMODE <``string``>::
 495 Extended version of _MODE_. This column may grow; new letters may be
 496 appended to _XMODE_ when *lsfd* supports a new state of file descriptors
 497 and/or memory mappings.
 498 +
 499 [-r]:::
 500 opened of mapped for reading. This is also in _MODE_.
 501 +
 502 [-w]:::
 503 opened of mapped for writing. This is also in _MODE_.
 504 +
 505 [-x]:::
 506 mapped for executing the code. This is also in _MODE_.
 507 +
 508 [-D]:::
 509 deleted from  the file system. See also _DELETED._.
 510 +
 511 [-Ll]:::
 512 locked or leased. _l_ represents a read, a shared lock or a read lease.
 513 _L_ represents a write or an exclusive lock or a write lease. If both
 514 read/shared and write/exclusive locks or leases are taken by a file
 515 descriptor, _L_ is used as the flag.
 516 +
 517 [-m]:::
 518 Multiplexed. If the file descriptor is targeted by a eventpoll file,
 519 this bit flag is set.
 520
 521 == FILTER EXPRESSION
 522
 523 *lsfd* evaluates the expression passed to *--filter* option every time
 524 before printing a file line. *lsfd* prints the line only if the result
 525 of evaluation is `true`.
 526
 527 An expression consists of column names, literals and, operators like:
 528 `DELETED`, `(PID == 1)`, `(NAME == "/etc/passwd")`, `(PID == 1) && DELETED`.
 529 `DELETED`, `PID`, and `NAME` are column names in the example.
 530 `1` and "/etc/passwd" are literals.
 531 `==` and `&&` are operators.
 532
 533 Before evaluation, *lsfd* substitutes column names in the given
 534 expression with actual column values in the line. There are three
 535 different data types: `boolean`, `string`, and `number`.  For columns
 536 with a `boolean` type, the value can be stand-alone.  For `string` and
 537 `number` values, the value must be an operand of an operator, for
 538 example, `(PID == 1)`. See *OUTPUT COLUMNS* about the types of
 539 columns.
 540
 541 Literal is for representing a value directly. See BOOLLIT, STRLIT, and
 542 NUMLIT. Different data types have different literal syntax.
 543
 544 An operator works with one or two operand(s). An operator has an
 545 expectation about the data type(s) of its operands. Giving an
 546 unexpected data type to an operator causes a syntax error.
 547
 548 Operators taking two operands are `and`, `or`, `eq`, `ne`, `le`, `lt`, `ge`, `gt`, `=~`, `!~`.
 549 Alphabetically named operators have C-language
 550 flavored aliases: `&&`, `||`, `==`, `!=`, `<`, `<=`, `>=`, and `>`.
 551
 552 `!` is the only operator that takes one operand.
 553
 554 `eq`, `ne`, and their aliases expect operands have the same data type.
 555 Applying these operators return a `boolean`.
 556
 557 `and`, `or`, `not` and their aliases expect operands have `boolean` data
 558 type. Applying these operators return a `boolean`.
 559
 560 `lt`, `le`, `gt`, `ge`, and their aliases expect operands have
 561 `number` data types. Applying these operators return a `boolean`.
 562
 563 `=~` is for regular expression matching; if a string at the right side
 564 matches a regular expression at the left side, the result is true.
 565 The right side operand must be a string literal. See STRLIT about the
 566 syntax.
 567
 568 `!~` is a short-hand version of `not (STR =~ PAT)`; it inverts the
 569 result of `=~`.
 570
 571 === Limitations
 572
 573 The current implementation does not define precedences within
 574 operators.  Use `(` and `)` explicitly for grouping the
 575 sub-expressions if your expression uses more than two operators.
 576
 577 About `number` typed values, the filter engine supports only
 578 non-negative integers, and non-negative floating point numbers.
 579
 580 === Semi-formal syntax
 581
 582 //TRANSLATORS: In the following messages, translate only the <``variables``>.
 583 EXPR :: BOOLEXP
 584
 585 BOOLEXP0 :: COLUMN <``boolean``> | BOOLLIT | _(_ BOOLEXP _)_
 586
 587 BOOLEXP :: BOOLEXP0 | BOOLOP1 | BOOLOP2 | BOOLOP2BL | BOOLOP2CMP | BOOLOP2REG
 588
 589 COLUMN :: [\_A-Za-z][-_:A-Za-z0-9]*
 590
 591 BOOLOP1 :: _!_ BOOLEXP0 | _not_ BOOLEXP0
 592
 593 STREXP :: COLUMN <``string``> | STRLIT
 594
 595 NUMEXP :: COLUMN <``number``> | NUMLIT
 596
 597 BOOLLIT :: _true_ | _false_
 598
 599 CHARS  :: ( [^\] | _\\_ | _\'_ | _\"_ )*
 600
 601 STRLIT :: _'_ CHARS _'_ | _"_ CHARS _"_
 602
 603 NUMLIT :: INTLIT | FNUMLIT
 604
 605 INTLIT :: [1-9][0-9]* | _0_
 606
 607 FNUMLIT :: INTLIT _._ [0-9][0-9]*
 608
 609 BOOLOP2 :: STREXP OP2 STREXP | NUMEXP OP2 NUMEXP | BOOLEXP0 OP2 BOOLEXP0
 610
 611 OP2   :: _==_ | _eq_ | _!=_ | _ne_
 612
 613 BOOLOP2BL :: BOOLEXP0 OP2BL BOOLEXP0
 614
 615 OP2BL ::  _&&_ | _and_ |  _||_ | _or_
 616
 617 BOOLOP2CMP :: NUMEXP OP2CMP NUMEXP
 618
 619 OP2CMP :: _<_ | _lt_ | _\<=_ | _le_ | _>_ | _gt_ | _>=_ | _ge_
 620
 621 BOOLOP2REG :: STREXP OP2REG STRLIT
 622
 623 OP2REG :: _=~_ | _!~_
 624
 625 == FILTER EXAMPLES
 626
 627 *lsfd* has few options for filtering. In most of cases, what you should
 628 know is *-Q* (or *--filter*) option.  Combined with *-o* (or
 629 *--output*) option, you can customize the output as you want.
 630
 631 //TRANSLATORS: In the following messages, don't forget to add whitespace at the end!
 632 List files associated with PID 1 and PID 2 processes: ::
 633 ....
 634 # lsfd -Q '(PID == 1) or (PID == 2)'
 635 ....
 636
 637 Do the same in an alternative way: ::
 638 ....
 639 # lsfd -Q '(PID == 1) || (PID == 2)'
 640 ....
 641
 642 Do the same in a more efficient way: ::
 643 ....
 644 # lsfd --pid 1,2
 645 ....
 646
 647 Whitescapes can be used instead of a comma: ::
 648 ....
 649 # lsfd --pid '1 2'
 650 ....
 651
 652 Utilize *pidof*(1) for list the files associated with "firefox": ::
 653 ....
 654 # lsfd --pid "$(pidof firefox)"
 655 ....
 656
 657 List the 1st file descriptor opened by PID 1 process: ::
 658 ....
 659 # lsfd -Q '(PID == 1) and (FD == 1)'
 660 ....
 661
 662 Do the same in an alternative way: ::
 663 ....
 664 # lsfd -Q '(PID == 1) && (FD == 1)'
 665 ....
 666
 667 List all running executables: ::
 668 ....
 669 # lsfd -Q 'ASSOC == "exe"'
 670 ....
 671
 672 Do the same in an alternative way: ::
 673 ....
 674 # lsfd -Q 'ASSOC eq "exe"'
 675 ....
 676
 677 Do the same but print only file names: ::
 678 ....
 679 # lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u
 680 ....
 681
 682 List deleted files associated to processes: ::
 683 ....
 684 # lsfd -Q 'DELETED'
 685 ....
 686
 687 List non-regular files: ::
 688 ....
 689 # lsfd -Q 'TYPE != "REG"'
 690 ....
 691
 692 List block devices: ::
 693 ....
 694 # lsfd -Q 'DEVTYPE == "blk"'
 695 ....
 696
 697 Do the same with TYPE column: ::
 698 ....
 699 # lsfd -Q 'TYPE == "BLK"'
 700 ....
 701
 702 List files including "dconf" directory in their names: ::
 703 ....
 704 # lsfd -Q 'NAME =~ ".\*/dconf/.*"'
 705 ....
 706
 707 List files opened in a QEMU virtual machine: ::
 708 ....
 709 # lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)'
 710 ....
 711
 712 Hide files associated to kernel threads: ::
 713 ....
 714 # lsfd -Q '!KTHREAD'
 715 ....
 716
 717 List timerfd files expired within 0.5 seconds: ::
 718 ....
 719 # lsfd -Q '(TIMERFD.remaining < 0.5) and (TIMERFD.remaining > 0.0)'
 720 ....
 721
 722 == COUNTER EXAMPLES
 723
 724 Report the numbers of netlink socket descriptors and unix socket descriptors: ::
 725 ....
 726 # lsfd --summary=only \
 727         -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
 728         -C 'unix sockets':'(NAME =~ "UNIX:.*")'
 729 VALUE COUNTER
 730    57 netlink sockets
 731  1552 unix sockets
 732 ....
 733
 734 Do the same but print in JSON format: ::
 735 ....
 736 # lsfd --summary=only --json \
 737         -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
 738         -C 'unix sockets':'(NAME =~ "UNIX:.*")'
 739 {
 740    "lsfd-summary": [
 741       {
 742          "value": 15,
 743          "counter": "netlink sockets"
 744       },{
 745          "value": 798,
 746          "counter": "unix sockets"
 747       }
 748    ]
 749 }
 750 ....
 751
 752
 753 == HISTORY
 754
 755 The *lsfd* command is part of the util-linux package since v2.38.
 756
 757 == AUTHORS
 758
 759 mailto:yamato@redhat.com[Masatake YAMATO],
 760 mailto:kzak@redhat.com[Karel Zak]
 761
 762 == SEE ALSO
 763 *bpftool*(8)
 764 *lslocks*(8)
 765 *lsof*(8)
 766 *pidof*(1)
 767 *proc*(5)
 768 *socket*(2)
 769 *stat*(2)
 770
 771 include::man-common/bugreports.adoc[]
 772
 773 include::man-common/footer.adoc[]
 774
 775 ifdef::translation[]
 776 include::man-common/translation.adoc[]
 777 endif::[]