misc-utils/lsfd.1.adoc

   1 //po4a: entry man manual
   2 ////
   3 Copyright 2021 Red Hat, Inc.
   4
   5 This file may be copied under the terms of the GNU Public License.
   6 ////
   7 = lsfd(1)
   8 :doctype: manpage
   9 :man manual: User Commands
  10 :man source: util-linux {release-version}
  11 :page-layout: base
  12 :command: lsfd
  13 :colon: :
  14
  15 == NAME
  16
  17 lsfd - list file descriptors
  18
  19 == SYNOPSIS
  20
  21 *lsfd* [option]
  22
  23 == DESCRIPTION
  24
  25 *lsfd* is intended to be a modern replacement for *lsof*(8) on Linux systems.
  26 Unlike *lsof*, *lsfd* is specialized to Linux kernel; it supports Linux
  27 specific features like namespaces with simpler code. *lsfd* is not a
  28 drop-in replacement for *lsof*; they are different in the command line
  29 interface and output formats.
  30
  31 The default output is subject to change. So whenever possible, you should avoid using
  32 default outputs in your scripts. Always explicitly define expected columns by using
  33 *--output* _columns-list_ in environments where a stable output is required.
  34
  35 *lsfd* uses Libsmartcols for output formatting and filtering. See the description of *--output*
  36 option for customizing the output format, and *--filter* option for filtering. Use *lsfd --help*
  37 to get a list of all available columns.
  38
  39 == OPTIONS
  40
  41 *-l*, *--threads*::
  42 List in threads level.
  43
  44 *-J*, *--json*::
  45 Use JSON output format.
  46
  47 *-n*, *--noheadings*::
  48 Don't print headings.
  49
  50 *-o*, *--output* _list_::
  51 Specify which output columns to print. See the *OUTPUT COLUMNS*
  52 section for details of available columns.
  53 +
  54 The default list of columns may be extended if _list_ is specified in
  55 the format +_list_ (e.g., *lsfd -o +DELETED*).
  56
  57 *-r*, *--raw*::
  58 Use raw output format.
  59
  60 *--notruncate*::
  61 Don't truncate text in columns.
  62
  63 *-p*, *--pid* _pids_::
  64 Collect information only for specified processes.
  65 _pids_ is a list of pids. A comma or whitespaces can be used as separators.
  66 You can use this option with *pidof*(1). See *FILTER EXAMPLES*.
  67 +
  68 Both *-Q* option with an expression including PID, e.g. -Q (PID == 1),
  69 and *-p* option, e.g. -p 1, may print the same output but using *-p*
  70 option is much more efficient because *-p* option works at a much earlier
  71 stage of processing than the *-Q* option.
  72
  73 *-i*[4|6], *--inet*[=4|6]::
  74 List only IPv4 sockets and/or IPv6 sockets.
  75
  76 *-Q*, *--filter* _expr_::
  77 Print only the files matching the condition represented by the _expr_.
  78 See also *FILTER EXAMPLES*.
  79
  80 *-C*, *--counter* __label__:__filter_expr__::
  81 Define a custom counter used in *--summary* output. *lsfd* makes a
  82 counter named _label_. During collect information, *lsfd* counts files
  83 matching _filter_expr_, and stores the counted number to the
  84 counter named _label_. *lsfd* applies filters defined with *--filter*
  85 options before counting; files excluded by the filters are not counted.
  86 +
  87 See *FILTER EXPRESSION* about _filter_expr_.
  88 _label_ should not include `{` nor `:`. You can define multiple
  89 counters by specifying this option multiple times.
  90 +
  91 See also *COUNTER EXAMPLES*.
  92
  93 *--summary*[=_when_]::
  94 This option controls summary lines output. The optional argument _when_
  95 can be *only*, *append* or *never*. If the _when_ argument is omitted,
  96 it defaults to *only*.
  97 +
  98 The summary reports counters. A counter consists of a label and an
  99 integer value.  *--counter* is the option for defining a counter.  If
 100 a user defines no counter, *lsfd* uses the definitions of pre-defined
 101 built-in counters (default counters) to make the summary output.
 102 +
 103 CAUTION{colon} Using *--summary* and *--json* may make the output broken. Only combining *--summary*=*only* and *--json* is valid.
 104 //TRANSLATORS: Keep {colon} untranslated.
 105
 106 *--debug-filter*::
 107 Dump the internal data structure for the filter and exit. This is useful
 108 only for *lsfd* developers.
 109
 110 *--dump-counters*::
 111 Dump the definition of counters used in *--summary* output.
 112
 113 include::man-common/help-version.adoc[]
 114
 115 == OUTPUT COLUMNS
 116
 117 Each column has a type. Types are surround by < and >.
 118
 119 //TRANSLATORS: Keep {colon} untranslated.
 120 CAUTION{colon} The names and types of columns are not stable yet.
 121 They may be changed in the future releases.
 122
 123 AINODECLASS <``string``>::
 124 Class of anonymous inode.
 125
 126 ASSOC <``string``>::
 127 Association between file and process.
 128
 129 BLKDRV <``string``>::
 130 Block device driver name resolved by `/proc/devices`.
 131
 132 CHRDRV <``string``>::
 133 Character device driver name resolved by `/proc/devices`.
 134
 135 COMMAND <``string``>::
 136 Command of the process opening the file.
 137
 138 DELETED <``boolean``>::
 139 Reachability from the file system.
 140
 141 DEV <``string``>::
 142 ID of the device containing the file.
 143
 144 DEVTYPE <``string``>::
 145 Device type (`blk`, `char`, or `nodev`).
 146
 147 ENDPOINT <``string``>::
 148 IPC endpoints information communicated with the fd.
 149 +
 150 *lsfd* collects endpoints within the processes that
 151 *lsfd* scans; *lsfd* may miss some endpoints
 152 if you limits the processes with *-p* option.
 153 +
 154 The format of the column depends on the object associated
 155 with the fd:
 156
 157 FIFO type:::
 158 mqueue type:::
 159 _PID_,_COMMAND_,_ASSOC_[-r][-w]
 160 +
 161 The last characters ([-r][-w]) represents the read and/or
 162 write mode of the endpoint.
 163
 164 eventfd type:::
 165 _PID_,_COMMAND_,_ASSOC_
 166
 167 EVENTFD.ID <``number``>::
 168 Eventfd ID.
 169
 170 EVENTPOLL.TFDS <``string``>::
 171 File descriptors targeted by the eventpoll file.
 172
 173 FD <``number``>::
 174 File descriptor for the file.
 175
 176 FLAGS <``string``>::
 177 Flags specified when opening the file.
 178
 179 FUID <``number``>::
 180 User ID number of the file's owner.
 181
 182 INET.LADDR <``string``>::
 183 Local IP address.
 184
 185 INET.RADDR <``string``>::
 186 Remote IP address.
 187
 188 INET6.LADDR <``string``>::
 189 Local IP6 address.
 190
 191 INET6.RADDR <``string``>::
 192 Remote IP6 address.
 193
 194 INODE <``number``>::
 195 Inode number.
 196
 197 INOTIFY.INODES <``string``>::
 198 Cooked version of INOTIFY.INODES.RAW.
 199 The format of the element is
 200 _inode-number_,_source-of-inode_.
 201
 202 INOTIFY.INODES.RAW <``string``>::
 203 List of monitoring inodes. The format of the element
 204 is _inode-number_,_device-major_:_device-minor_.
 205
 206 KNAME <``string``>::
 207 //
 208 // It seems that the manpage backend of asciidoctor has limitations
 209 // about emitting text with nested face specifications like:
 210 //
 211 //   `_u_` p
 212 //
 213 // Not only u but also p is decorated with underline.
 214 //
 215 Raw file name extracted from
 216 from ``/proc/``_pid_``/fd/``_fd_ or ``/proc/``_pid_``/map_files/``_region_.
 217
 218 KTHREAD <``boolean``>::
 219 Whether the process is a kernel thread or not.
 220
 221 MAJ:MIN <``string``>::
 222 Device ID for special, or ID of device containing file.
 223
 224 MAPLEN <``number``>::
 225 Length of file mapping (in page).
 226
 227 MISCDEV <``string``>::
 228 Misc character device name resolved by `/proc/misc`.
 229
 230 MNTID <``number``>::
 231 Mount ID.
 232
 233 MODE <``string``>::
 234 Access mode (rwx).
 235
 236 NAME <``string``>::
 237 Cooked version of KNAME. It is mostly same as KNAME.
 238
 239 ____
 240 Note that `(deleted)` markers are removed from this column.
 241 Refer to _KNAME_, _DELETED_, or _XMODE_ to know the
 242 readability of the file from the file system.
 243 ____
 244
 245 +
 246 Some files have special formats and information sources:
 247 +
 248 eventpoll:::
 249 tfds=_EVENTPOLL.TFDS_
 250 +
 251 eventfd:::
 252 id=_EVENTFD.ID_
 253 +
 254 inotify:::
 255 inodes=_INOTIFY.INODES_
 256 +
 257 misc:tun:::
 258 iface=_TUN.IFACE_
 259 +
 260 NETLINK:::
 261 protocol=_NETLINK.PROTOCOL_[ lport=_NETLINK.LPORT_[ group=_NETLINK.GROUPS_]]
 262 +
 263 PACKET:::
 264 type=_SOCK.TYPE_[ protocol=_PACKET.PROTOCOL_][ iface=_PACKET.IFACE_]
 265 +
 266 pidfd:::
 267 pid=_TARGET-PID_ comm=_TARGET-COMMAND_ nspid=_TARGET-NSPIDS_
 268 +
 269 *lsfd* extracts _TARGET-PID_ and _TARGET-NSPIDS_ from
 270 ``/proc/``_pid_``/fdinfo/``_fd_.
 271 +
 272 PING:::
 273 state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]
 274 +
 275 PINGv6:::
 276 state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]
 277 +
 278 RAW:::
 279 state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]]
 280 +
 281 RAWv6:::
 282 state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]]
 283 +
 284 signalfd:::
 285 mask=_SIGNALFD.MASK_
 286 +
 287 TCP:::
 288 TCPv6:::
 289 state=_SOCK.STATE_[ laddr=_TCP.LADDR_ [ raddr=_TCP.RADDR_]]
 290 +
 291 timerfd:::
 292 clockid=_TIMERFD.CLOCKID_[ remaining=_TIMERFD.REMAINING_ [ interval=_TIMERFD.INTERVAL_]]
 293 +
 294 UDP:::
 295 UDPv6:::
 296 state=_SOCK.STATE_[ laddr=_UDP.LADDR_ [ raddr=_UDP.RADDR_]]
 297 +
 298 *lsfd* hides ``raddr=`` if _UDP.RADDR_ is ``0.0.0.0`` and _UDP.RPORT_ is 0.
 299 +
 300 UDP-LITE:::
 301 UDPLITEv6:::
 302 state=_SOCK.STATE_[ laddr=_UDPLITE.LADDR_ [ raddr=_UDPLITE.RADDR_]]
 303 +
 304 UNIX-STREAM:::
 305 state=_SOCK.STATE_[ path=_UNIX.PATH_]
 306 +
 307 UNIX:::
 308 state=_SOCK.STATE_[ path=_UNIX.PATH_] type=_SOCK.TYPE_
 309
 310 NETLINK.GROUPS <``number``>::
 311 Netlink multicast groups.
 312
 313 NETLINK.LPORT <``number``>::
 314 Netlink local port id.
 315
 316 NETLINK.PROTOCOL <``string``>::
 317 Netlink protocol.
 318
 319 NLINK <``number``>::
 320 Link count.
 321
 322 NS.NAME <``string``>::
 323 Name (_NS.TYPE_:[_INODE_]) of the namespace specified with the file.
 324
 325 NS.TYPE <``string``>::
 326 Type of the namespace specified with the file.
 327 The type is `mnt`, `cgroup`, `uts`, `ipc`, `user`, `pid`, `net`,
 328 `time`, or `unknown`.
 329
 330 OWNER <``string``>::
 331 Owner of the file.
 332
 333 PACKET.IFACE <``string``>::
 334 Interface name associated with the packet socket.
 335
 336 PACKET.PROTOCOL <``string``>::
 337 L3 protocol associated with the packet socket.
 338
 339 PARTITION <``string``>::
 340 Block device name resolved by `/proc/partition`.
 341
 342 PID <``number``>::
 343 PID of the process opening the file.
 344
 345 PIDFD.COMM <``string``>::
 346 Command of the process targeted by the pidfd.
 347
 348 PIDFD.NSPID <``string``>::
 349 Value of NSpid field in ``/proc/``_pid_``/fdinfo/``_fd_ of the pidfd.
 350 +
 351 Quoted from kernel/fork.c of Linux source tree:
 352 +
 353 ____
 354 If pid namespaces are supported then this function will also print
 355 the pid of a given pidfd refers to for all descendant pid namespaces
 356 starting from the current pid namespace of the instance, i.e. the
 357 Pid field and the first entry in the NSpid field will be identical.
 358
 359 Note that this differs from the Pid and NSpid fields in
 360 /proc/<pid>/status where Pid and NSpid are always shown relative to
 361 the pid namespace of the procfs instance.
 362 ____
 363
 364 PIDFD.PID <``number``>::
 365 PID of the process targeted by the pidfd.
 366
 367 PING.ID <`number`>::
 368 ICMP echo request id used on the PING socket.
 369
 370 POS <``number``>::
 371 File position.
 372
 373 RAW.PROTOCOL <``number``>::
 374 Protocol number of the raw socket.
 375
 376 RDEV <``string``>::
 377 Device ID (if special file).
 378
 379 SIGNALFD.MASK <``string``>::
 380 Masked signals.
 381
 382 SIZE <``number``>::
 383 File size.
 384
 385 SOCK.LISTENING <``boolean``>::
 386 Listening socket.
 387
 388 SOCK.NETS <``number``>::
 389 Inode identifying network namespace where the socket belongs to.
 390
 391 SOCK.PROTONAME <``string``>::
 392 Protocol name.
 393
 394 SOCK.STATE <``string``>::
 395 State of socket.
 396
 397 SOCK.TYPE <``string``>::
 398 Type of socket. Here type means the second parameter of
 399 socket system call:
 400 +
 401 * stream
 402 * dgram
 403 * raw
 404 * rdm
 405 * seqpacket
 406 * dccp
 407 * packet
 408
 409 SOURCE <``string``>::
 410 File system, partition, or device containing the file.
 411
 412 STTYPE <``string``>::
 413 Raw file types returned from *stat*(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN.
 414
 415 TCP.LADDR <``string``>::
 416 Local L3 (INET.LADDR or INET6.LADDR) address and local TCP port.
 417
 418 TCP.LPORT <``number``>::
 419 Local TCP port.
 420
 421 TCP.RADDR <``string``>::
 422 Remote L3 (INET.RADDR or INET6.RADDR) address and remote TCP port.
 423
 424 TCP.RPORT <``number``>::
 425 Remote TCP port.
 426
 427 TID <``number``>::
 428 Thread ID of the process opening the file.
 429
 430 TIMERFD.CLOCKID <``string``>::
 431 Clockid.
 432
 433 TIMERFD.INTERVAL <``number``>::
 434 Interval.
 435
 436 TIMERFD.REMAINING <``number``>::
 437 Remaining time.
 438
 439 TUN.IFACE <``string``>::
 440 Network intrface behind the tun device.
 441
 442 TYPE <``string``>::
 443 Cooked version of STTYPE. It is same as STTYPE with exceptions.
 444 For SOCK, print the value for SOCK.PROTONAME.
 445 For UNKN, print the value for AINODECLASS if SOURCE is anon_inodefs.
 446
 447 UDP.LADDR <``string``>::
 448 Local IP address and local UDP port.
 449
 450 UDP.LPORT <``number``>::
 451 Local UDP port.
 452
 453 UDP.RADDR <``string``>::
 454 Remote IP address and remote UDP port.
 455
 456 UDP.RPORT <``number``>::
 457 Remote UDP port.
 458
 459 UDPLITE.LADDR <``string``>::
 460 Local IP address and local UDPLite port.
 461
 462 UDPLITE.LPORT <``number``>::
 463 Local UDP port.
 464
 465 UDPLITE.RADDR <``string``>::
 466 Remote IP address and remote UDPLite port.
 467
 468 UDPLITE.RPORT <``number``>::
 469 Remote UDP port.
 470
 471 UID <``number``>::
 472 User ID number.
 473
 474 UNIX.PATH <``string``>::
 475 Filesystem pathname for UNIX domain socket.
 476
 477 USER <``string``>::
 478 User of the process.
 479
 480 XMODE <``string``>::
 481 Extended version of _MODE_. This column may grow; new letters may be
 482 added to _XMODE_ when *lsfd* supports a new state of file descriptors
 483 and/or memory mappings.
 484 +
 485 [-r]:::
 486 opened of mapped for reading. This is also in _MODE_.
 487 +
 488 [-w]:::
 489 opened of mapped for writing. This is also in _MODE_.
 490 +
 491 [-x]:::
 492 mapped for executing the code. This is also in _MODE_.
 493 +
 494 [-D]:::
 495 opened file is deleted from  the file system. See also _DELETED._.
 496
 497 == FILTER EXPRESSION
 498
 499 *lsfd* evaluates the expression passed to *--filter* option every time
 500 before printing a file line. *lsfd* prints the line only if the result
 501 of evaluation is `true`.
 502
 503 An expression consists of column names, literals and, operators like:
 504 `DELETED`, `(PID == 1)`, `(NAME == "/etc/passwd")`, `(PID == 1) && DELETED`.
 505 `DELETED`, `PID`, and `NAME` are column names in the example.
 506 `1` and "/etc/passwd" are literals.
 507 `==` and `&&` are operators.
 508
 509 Before evaluation, *lsfd* substitutes column names in the given
 510 expression with actual column values in the line. There are three
 511 different data types: `boolean`, `string`, and `number`.  For columns
 512 with a `boolean` type, the value can be stand-alone.  For `string` and
 513 `number` values, the value must be an operand of an operator, for
 514 example, `(PID == 1)`. See *OUTPUT COLUMNS* about the types of
 515 columns.
 516
 517 Literal is for representing a value directly. See BOOLLIT, STRLIT, and
 518 NUMLIT. Different data types have different literal syntax.
 519
 520 An operator works with one or two operand(s). An operator has an
 521 expectation about the data type(s) of its operands. Giving an
 522 unexpected data type to an operator causes a syntax error.
 523
 524 Operators taking two operands are `and`, `or`, `eq`, `ne`, `le`, `lt`, `ge`, `gt`, `=~`, `!~`.
 525 Alphabetically named operators have C-language
 526 flavored aliases: `&&`, `||`, `==`, `!=`, `<`, `<=`, `>=`, and `>`.
 527
 528 `!` is the only operator that takes one operand.
 529
 530 `eq`, `ne`, and their aliases expect operands have the same data type.
 531 Applying these operators return a `boolean`.
 532
 533 `and`, `or`, `not` and their aliases expect operands have `boolean` data
 534 type. Applying these operators return a `boolean`.
 535
 536 `lt`, `le`, `gt`, `ge`, and their aliases expect operands have
 537 `number` data types. Applying these operators return a `boolean`.
 538
 539 `=~` is for regular expression matching; if a string at the right side
 540 matches a regular expression at the left side, the result is true.
 541 The right side operand must be a string literal. See STRLIT about the
 542 syntax.
 543
 544 `!~` is a short-hand version of `not (STR =~ PAT)`; it inverts the
 545 result of `=~`.
 546
 547 === Limitations
 548
 549 The current implementation does not define precedences within
 550 operators.  Use `(` and `)` explicitly for grouping the
 551 sub-expressions if your expression uses more than two operators.
 552
 553 About `number` typed values, the filter engine supports only
 554 non-negative integers, and non-negative floating point numbers.
 555
 556 === Semi-formal syntax
 557
 558 //TRANSLATORS: In the following messages, translate only the <``variables``>.
 559 EXPR :: BOOLEXP
 560
 561 BOOLEXP0 :: COLUMN <``boolean``> | BOOLLIT | _(_ BOOLEXP _)_
 562
 563 BOOLEXP :: BOOLEXP0 | BOOLOP1 | BOOLOP2 | BOOLOP2BL | BOOLOP2CMP | BOOLOP2REG
 564
 565 COLUMN :: [\_A-Za-z][-_:A-Za-z0-9]*
 566
 567 BOOLOP1 :: _!_ BOOLEXP0 | _not_ BOOLEXP0
 568
 569 STREXP :: COLUMN <``string``> | STRLIT
 570
 571 NUMEXP :: COLUMN <``number``> | NUMLIT
 572
 573 BOOLLIT :: _true_ | _false_
 574
 575 CHARS  :: ( [^\] | _\\_ | _\'_ | _\"_ )*
 576
 577 STRLIT :: _'_ CHARS _'_ | _"_ CHARS _"_
 578
 579 NUMLIT :: INTLIT | FNUMLIT
 580
 581 INTLIT :: [1-9][0-9]* | _0_
 582
 583 FNUMLIT :: INTLIT _._ [0-9][0-9]*
 584
 585 BOOLOP2 :: STREXP OP2 STREXP | NUMEXP OP2 NUMEXP | BOOLEXP0 OP2 BOOLEXP0
 586
 587 OP2   :: _==_ | _eq_ | _!=_ | _ne_
 588
 589 BOOLOP2BL :: BOOLEXP0 OP2BL BOOLEXP0
 590
 591 OP2BL ::  _&&_ | _and_ |  _||_ | _or_
 592
 593 BOOLOP2CMP :: NUMEXP OP2CMP NUMEXP
 594
 595 OP2CMP :: _<_ | _lt_ | _\<=_ | _le_ | _>_ | _gt_ | _>=_ | _ge_
 596
 597 BOOLOP2REG :: STREXP OP2REG STRLIT
 598
 599 OP2REG :: _=~_ | _!~_
 600
 601 == FILTER EXAMPLES
 602
 603 *lsfd* has few options for filtering. In most of cases, what you should
 604 know is *-Q* (or *--filter*) option.  Combined with *-o* (or
 605 *--output*) option, you can customize the output as you want.
 606
 607 //TRANSLATORS: In the following messages, don't forget to add whitespace at the end!
 608 List files associated with PID 1 and PID 2 processes: ::
 609 ....
 610 # lsfd -Q '(PID == 1) or (PID == 2)'
 611 ....
 612
 613 Do the same in an alternative way: ::
 614 ....
 615 # lsfd -Q '(PID == 1) || (PID == 2)'
 616 ....
 617
 618 Do the same in a more efficient way: ::
 619 ....
 620 # lsfd --pid 1,2
 621 ....
 622
 623 Whitescapes can be used instead of a comma: ::
 624 ....
 625 # lsfd --pid '1 2'
 626 ....
 627
 628 Utilize *pidof*(1) for list the files associated with "firefox": ::
 629 ....
 630 # lsfd --pid "$(pidof firefox)"
 631 ....
 632
 633 List the 1st file descriptor opened by PID 1 process: ::
 634 ....
 635 # lsfd -Q '(PID == 1) and (FD == 1)'
 636 ....
 637
 638 Do the same in an alternative way: ::
 639 ....
 640 # lsfd -Q '(PID == 1) && (FD == 1)'
 641 ....
 642
 643 List all running executables: ::
 644 ....
 645 # lsfd -Q 'ASSOC == "exe"'
 646 ....
 647
 648 Do the same in an alternative way: ::
 649 ....
 650 # lsfd -Q 'ASSOC eq "exe"'
 651 ....
 652
 653 Do the same but print only file names: ::
 654 ....
 655 # lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u
 656 ....
 657
 658 List deleted files associated to processes: ::
 659 ....
 660 # lsfd -Q 'DELETED'
 661 ....
 662
 663 List non-regular files: ::
 664 ....
 665 # lsfd -Q 'TYPE != "REG"'
 666 ....
 667
 668 List block devices: ::
 669 ....
 670 # lsfd -Q 'DEVTYPE == "blk"'
 671 ....
 672
 673 Do the same with TYPE column: ::
 674 ....
 675 # lsfd -Q 'TYPE == "BLK"'
 676 ....
 677
 678 List files including "dconf" directory in their names: ::
 679 ....
 680 # lsfd -Q 'NAME =~ ".\*/dconf/.*"'
 681 ....
 682
 683 List files opened in a QEMU virtual machine: ::
 684 ....
 685 # lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)'
 686 ....
 687
 688 Hide files associated to kernel threads: ::
 689 ....
 690 # lsfd -Q '!KTHREAD'
 691 ....
 692
 693 List timerfd files expired within 0.5 seconds: ::
 694 ....
 695 # lsfd -Q '(TIMERFD.remaining < 0.5) and (TIMERFD.remaining > 0.0)'
 696 ....
 697
 698 == COUNTER EXAMPLES
 699
 700 Report the numbers of netlink socket descriptors and unix socket descriptors: ::
 701 ....
 702 # lsfd --summary=only \
 703         -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
 704         -C 'unix sockets':'(NAME =~ "UNIX:.*")'
 705 VALUE COUNTER
 706    57 netlink sockets
 707  1552 unix sockets
 708 ....
 709
 710 Do the same but print in JSON format: ::
 711 ....
 712 # lsfd --summary=only --json \
 713         -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
 714         -C 'unix sockets':'(NAME =~ "UNIX:.*")'
 715 {
 716    "lsfd-summary": [
 717       {
 718          "value": 15,
 719          "counter": "netlink sockets"
 720       },{
 721          "value": 798,
 722          "counter": "unix sockets"
 723       }
 724    ]
 725 }
 726 ....
 727
 728
 729 == HISTORY
 730
 731 The *lsfd* command is part of the util-linux package since v2.38.
 732
 733 == AUTHORS
 734
 735 mailto:yamato@redhat.com[Masatake YAMATO],
 736 mailto:kzak@redhat.com[Karel Zak]
 737
 738 == SEE ALSO
 739
 740 *lsof*(8)
 741 *pidof*(1)
 742 *proc*(5)
 743 *socket*(2)
 744 *stat*(2)
 745
 746 include::man-common/bugreports.adoc[]
 747
 748 include::man-common/footer.adoc[]
 749
 750 ifdef::translation[]
 751 include::man-common/translation.adoc[]
 752 endif::[]