misc-utils/lsfd.1.adoc

   1 //po4a: entry man manual
   2 ////
   3 Copyright 2021 Red Hat, Inc.
   4
   5 This file may be copied under the terms of the GNU Public License.
   6 ////
   7 = lsfd(1)
   8 :doctype: manpage
   9 :man manual: User Commands
  10 :man source: util-linux {release-version}
  11 :page-layout: base
  12 :command: lsfd
  13 :colon: :
  14
  15 == NAME
  16
  17 lsfd - list file descriptors
  18
  19 == SYNOPSIS
  20
  21 *lsfd* [option]
  22
  23 == DESCRIPTION
  24
  25 *lsfd* is intended to be a modern replacement for *lsof*(8) on Linux systems.
  26 Unlike *lsof*, *lsfd* is specialized to Linux kernel; it supports Linux
  27 specific features like namespaces with simpler code. *lsfd* is not a
  28 drop-in replacement for *lsof*; they are different in the command line
  29 interface and output formats.
  30
  31 The default output is subject to change. So whenever possible, you should avoid using
  32 default outputs in your scripts. Always explicitly define expected columns by using
  33 *--output* _columns-list_ in environments where a stable output is required.
  34
  35 *lsfd* uses Libsmartcols for output formatting and filtering. See the description of *--output*
  36 option for customizing the output format, and *--filter* option for filtering. Use *lsfd --help*
  37 to get a list of all available columns.
  38
  39 == OPTIONS
  40
  41 *-l*, *--threads*::
  42 List in threads level.
  43
  44 *-J*, *--json*::
  45 Use JSON output format.
  46
  47 *-n*, *--noheadings*::
  48 Don't print headings.
  49
  50 *-o*, *--output* _list_::
  51 Specify which output columns to print. See the *OUTPUT COLUMNS*
  52 section for details of available columns.
  53 +
  54 The default list of columns may be extended if _list_ is specified in
  55 the format +_list_ (e.g., *lsfd -o +DELETED*).
  56
  57 *-r*, *--raw*::
  58 Use raw output format.
  59
  60 *--notruncate*::
  61 Don't truncate text in columns.
  62
  63 *-p*, *--pid* _pids_::
  64 Collect information only for specified processes.
  65 _pids_ is a list of pids. A comma or whitespaces can be used as separators.
  66 You can use this option with *pidof*(1). See *FILTER EXAMPLES*.
  67 +
  68 Both *-Q* option with an expression including PID, e.g. -Q (PID == 1),
  69 and *-p* option, e.g. -p 1, may print the same output but using *-p*
  70 option is much more efficient because *-p* option works at a much earlier
  71 stage of processing than the *-Q* option.
  72
  73 *-i*[4|6], *--inet*[=4|6]::
  74 List only IPv4 sockets and/or IPv6 sockets.
  75
  76 *-Q*, *--filter* _expr_::
  77 Print only the files matching the condition represented by the _expr_.
  78 See also *FILTER EXAMPLES*.
  79
  80 *-C*, *--counter* __label__:__filter_expr__::
  81 Define a custom counter used in *--summary* output. *lsfd* makes a
  82 counter named _label_. During collect information, *lsfd* counts files
  83 matching _filter_expr_, and stores the counted number to the
  84 counter named _label_. *lsfd* applies filters defined with *--filter*
  85 options before counting; files excluded by the filters are not counted.
  86 +
  87 See *FILTER EXPRESSION* about _filter_expr_.
  88 _label_ should not include `{` nor `:`. You can define multiple
  89 counters by specifying this option multiple times.
  90 +
  91 See also *COUNTER EXAMPLES*.
  92
  93 *--summary*[=_when_]::
  94 This option controls summary lines output. The optional argument _when_
  95 can be *only*, *append* or *never*. If the _when_ argument is omitted,
  96 it defaults to *only*.
  97 +
  98 The summary reports counters. A counter consists of a label and an
  99 integer value.  *--counter* is the option for defining a counter.  If
 100 a user defines no counter, *lsfd* uses the definitions of pre-defined
 101 built-in counters (default counters) to make the summary output.
 102 +
 103 CAUTION{colon} Using *--summary* and *--json* may make the output broken. Only combining *--summary*=*only* and *--json* is valid.
 104 //TRANSLATORS: Keep {colon} untranslated.
 105
 106 *--debug-filter*::
 107 Dump the internal data structure for the filter and exit. This is useful
 108 only for *lsfd* developers.
 109
 110 *--dump-counters*::
 111 Dump the definition of counters used in *--summary* output.
 112
 113 include::man-common/help-version.adoc[]
 114
 115 == OUTPUT COLUMNS
 116
 117 Each column has a type. Types are surround by < and >.
 118
 119 //TRANSLATORS: Keep {colon} untranslated.
 120 CAUTION{colon} The names and types of columns are not stable yet.
 121 They may be changed in the future releases.
 122
 123 AINODECLASS <``string``>::
 124 Class of anonymous inode.
 125
 126 ASSOC <``string``>::
 127 Association between file and process.
 128
 129 BLKDRV <``string``>::
 130 Block device driver name resolved by `/proc/devices`.
 131
 132 CHRDRV <``string``>::
 133 Character device driver name resolved by `/proc/devices`.
 134
 135 COMMAND <``string``>::
 136 Command of the process opening the file.
 137
 138 DELETED <``boolean``>::
 139 Reachability from the file system.
 140
 141 DEV <``string``>::
 142 ID of the device containing the file.
 143
 144 DEVTYPE <``string``>::
 145 Device type (`blk`, `char`, or `nodev`).
 146
 147 ENDPOINT <``string``>::
 148 IPC endpoints information communicated with the fd.
 149 +
 150 *lsfd* collects endpoints within the processes that
 151 *lsfd* scans; *lsfd* may miss some endpoints
 152 if you limits the processes with *-p* option.
 153 +
 154 The format of the column depends on the object associated
 155 with the fd:
 156
 157 FIFO type:::
 158 mqueue type:::
 159 _PID_,_COMMAND_,_ASSOC_[-r][-w]
 160 +
 161 The last characters ([-r][-w]) represents the read and/or
 162 write mode of the endpoint.
 163
 164 eventfd type:::
 165 _PID_,_COMMAND_,_ASSOC_
 166
 167 EVENTFD.ID <``number``>::
 168 Eventfd ID.
 169
 170 EVENTPOLL.TFDS <``string``>::
 171 File descriptors targeted by the eventpoll file.
 172
 173 FD <``number``>::
 174 File descriptor for the file.
 175
 176 FLAGS <``string``>::
 177 Flags specified when opening the file.
 178
 179 FUID <``number``>::
 180 User ID number of the file's owner.
 181
 182 INET.LADDR <``string``>::
 183 Local IP address.
 184
 185 INET.RADDR <``string``>::
 186 Remote IP address.
 187
 188 INET6.LADDR <``string``>::
 189 Local IP6 address.
 190
 191 INET6.RADDR <``string``>::
 192 Remote IP6 address.
 193
 194 INODE <``number``>::
 195 Inode number.
 196
 197 INOTIFY.INODES <``string``>::
 198 Cooked version of INOTIFY.INODES.RAW.
 199 The format of the element is
 200 _inode-number_,_source-of-inode_.
 201
 202 INOTIFY.INODES.RAW <``string``>::
 203 List of monitoring inodes. The format of the element
 204 is _inode-number_,_device-major_:_device-minor_.
 205
 206 KNAME <``string``>::
 207 //
 208 // It seems that the manpage backend of asciidoctor has limitations
 209 // about emitting text with nested face specifications like:
 210 //
 211 //   `_u_` p
 212 //
 213 // Not only u but also p is decorated with underline.
 214 //
 215 Raw file name extracted from
 216 from ``/proc/``_pid_``/fd/``_fd_ or ``/proc/``_pid_``/map_files/``_region_.
 217
 218 KTHREAD <``boolean``>::
 219 Whether the process is a kernel thread or not.
 220
 221 MAJ:MIN <``string``>::
 222 Device ID for special, or ID of device containing file.
 223
 224 MAPLEN <``number``>::
 225 Length of file mapping (in page).
 226
 227 MISCDEV <``string``>::
 228 Misc character device name resolved by `/proc/misc`.
 229
 230 MNTID <``number``>::
 231 Mount ID.
 232
 233 MODE <``string``>::
 234 Access mode (rwx).
 235
 236 NAME <``string``>::
 237 Cooked version of KNAME. It is mostly same as KNAME.
 238 +
 239 Some files have special formats and information sources:
 240 +
 241 eventpoll:::
 242 tfds=_EVENTPOLL.TFDS_
 243 +
 244 eventfd:::
 245 id=_EVENTFD.ID_
 246 +
 247 inotify:::
 248 inodes=_INOTIFY.INODES_
 249 +
 250 misc:tun:::
 251 iface=_TUN.IFACE_
 252 +
 253 NETLINK:::
 254 protocol=_NETLINK.PROTOCOL_[ lport=_NETLINK.LPORT_[ group=_NETLINK.GROUPS_]]
 255 +
 256 PACKET:::
 257 type=_SOCK.TYPE_[ protocol=_PACKET.PROTOCOL_][ iface=_PACKET.IFACE_]
 258 +
 259 pidfd:::
 260 pid=_TARGET-PID_ comm=_TARGET-COMMAND_ nspid=_TARGET-NSPIDS_
 261 +
 262 *lsfd* extracts _TARGET-PID_ and _TARGET-NSPIDS_ from
 263 ``/proc/``_pid_``/fdinfo/``_fd_.
 264 +
 265 PING:::
 266 state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]
 267 +
 268 PINGv6:::
 269 state=_SOCK.STATE_[ id=_PING.ID_][ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]
 270 +
 271 RAW:::
 272 state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET.LADDR_ [ raddr=_INET.RADDR_]]]
 273 +
 274 RAWv6:::
 275 state=_SOCK.STATE_[ protocol=_RAW.PROTOCOL_ [ laddr=_INET6.LADDR_ [ raddr=_INET6.RADDR_]]]
 276 +
 277 signalfd:::
 278 mask=_SIGNALFD.MASK_
 279 +
 280 TCP:::
 281 TCPv6:::
 282 state=_SOCK.STATE_[ laddr=_TCP.LADDR_ [ raddr=_TCP.RADDR_]]
 283 +
 284 timerfd:::
 285 clockid=_TIMERFD.CLOCKID_[ remaining=_TIMERFD.REMAINING_ [ interval=_TIMERFD.INTERVAL_]]
 286 +
 287 UDP:::
 288 UDPv6:::
 289 state=_SOCK.STATE_[ laddr=_UDP.LADDR_ [ raddr=_UDP.RADDR_]]
 290 +
 291 *lsfd* hides ``raddr=`` if _UDP.RADDR_ is ``0.0.0.0`` and _UDP.RPORT_ is 0.
 292 +
 293 UDP-LITE:::
 294 UDPLITEv6:::
 295 state=_SOCK.STATE_[ laddr=_UDPLITE.LADDR_ [ raddr=_UDPLITE.RADDR_]]
 296 +
 297 UNIX-STREAM:::
 298 state=_SOCK.STATE_[ path=_UNIX.PATH_]
 299 +
 300 UNIX:::
 301 state=_SOCK.STATE_[ path=_UNIX.PATH_] type=_SOCK.TYPE_
 302
 303 NETLINK.GROUPS <``number``>::
 304 Netlink multicast groups.
 305
 306 NETLINK.LPORT <``number``>::
 307 Netlink local port id.
 308
 309 NETLINK.PROTOCOL <``string``>::
 310 Netlink protocol.
 311
 312 NLINK <``number``>::
 313 Link count.
 314
 315 NS.NAME <``string``>::
 316 Name (_NS.TYPE_:[_INODE_]) of the namespace specified with the file.
 317
 318 NS.TYPE <``string``>::
 319 Type of the namespace specified with the file.
 320 The type is `mnt`, `cgroup`, `uts`, `ipc`, `user`, `pid`, `net`,
 321 `time`, or `unknown`.
 322
 323 OWNER <``string``>::
 324 Owner of the file.
 325
 326 PACKET.IFACE <``string``>::
 327 Interface name associated with the packet socket.
 328
 329 PACKET.PROTOCOL <``string``>::
 330 L3 protocol associated with the packet socket.
 331
 332 PARTITION <``string``>::
 333 Block device name resolved by `/proc/partition`.
 334
 335 PID <``number``>::
 336 PID of the process opening the file.
 337
 338 PIDFD.COMM <``string``>::
 339 Command of the process targeted by the pidfd.
 340
 341 PIDFD.NSPID <``string``>::
 342 Value of NSpid field in ``/proc/``_pid_``/fdinfo/``_fd_ of the pidfd.
 343 +
 344 Quoted from kernel/fork.c of Linux source tree:
 345 +
 346 ____
 347 If pid namespaces are supported then this function will also print
 348 the pid of a given pidfd refers to for all descendant pid namespaces
 349 starting from the current pid namespace of the instance, i.e. the
 350 Pid field and the first entry in the NSpid field will be identical.
 351
 352 Note that this differs from the Pid and NSpid fields in
 353 /proc/<pid>/status where Pid and NSpid are always shown relative to
 354 the pid namespace of the procfs instance.
 355 ____
 356
 357 PIDFD.PID <``number``>::
 358 PID of the process targeted by the pidfd.
 359
 360 PING.ID <`number`>::
 361 ICMP echo request id used on the PING socket.
 362
 363 POS <``number``>::
 364 File position.
 365
 366 RAW.PROTOCOL <``number``>::
 367 Protocol number of the raw socket.
 368
 369 RDEV <``string``>::
 370 Device ID (if special file).
 371
 372 SIGNALFD.MASK <``string``>::
 373 Masked signals.
 374
 375 SIZE <``number``>::
 376 File size.
 377
 378 SOCK.LISTENING <``boolean``>::
 379 Listening socket.
 380
 381 SOCK.NETS <``number``>::
 382 Inode identifying network namespace where the socket belongs to.
 383
 384 SOCK.PROTONAME <``string``>::
 385 Protocol name.
 386
 387 SOCK.STATE <``string``>::
 388 State of socket.
 389
 390 SOCK.TYPE <``string``>::
 391 Type of socket. Here type means the second parameter of
 392 socket system call:
 393 +
 394 * stream
 395 * dgram
 396 * raw
 397 * rdm
 398 * seqpacket
 399 * dccp
 400 * packet
 401
 402 SOURCE <``string``>::
 403 File system, partition, or device containing the file.
 404
 405 STTYPE <``string``>::
 406 Raw file types returned from *stat*(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN.
 407
 408 TCP.LADDR <``string``>::
 409 Local L3 (INET.LADDR or INET6.LADDR) address and local TCP port.
 410
 411 TCP.LPORT <``number``>::
 412 Local TCP port.
 413
 414 TCP.RADDR <``string``>::
 415 Remote L3 (INET.RADDR or INET6.RADDR) address and remote TCP port.
 416
 417 TCP.RPORT <``number``>::
 418 Remote TCP port.
 419
 420 TID <``number``>::
 421 Thread ID of the process opening the file.
 422
 423 TIMERFD.CLOCKID <``string``>::
 424 Clockid.
 425
 426 TIMERFD.INTERVAL <``number``>::
 427 Interval.
 428
 429 TIMERFD.REMAINING <``number``>::
 430 Remaining time.
 431
 432 TUN.IFACE <``string``>::
 433 Network intrface behind the tun device.
 434
 435 TYPE <``string``>::
 436 Cooked version of STTYPE. It is same as STTYPE with exceptions.
 437 For SOCK, print the value for SOCK.PROTONAME.
 438 For UNKN, print the value for AINODECLASS if SOURCE is anon_inodefs.
 439
 440 UDP.LADDR <``string``>::
 441 Local IP address and local UDP port.
 442
 443 UDP.LPORT <``number``>::
 444 Local UDP port.
 445
 446 UDP.RADDR <``string``>::
 447 Remote IP address and remote UDP port.
 448
 449 UDP.RPORT <``number``>::
 450 Remote UDP port.
 451
 452 UDPLITE.LADDR <``string``>::
 453 Local IP address and local UDPLite port.
 454
 455 UDPLITE.LPORT <``number``>::
 456 Local UDP port.
 457
 458 UDPLITE.RADDR <``string``>::
 459 Remote IP address and remote UDPLite port.
 460
 461 UDPLITE.RPORT <``number``>::
 462 Remote UDP port.
 463
 464 UID <``number``>::
 465 User ID number.
 466
 467 UNIX.PATH <``string``>::
 468 Filesystem pathname for UNIX domain socket.
 469
 470 USER <``string``>::
 471 User of the process.
 472
 473 == FILTER EXPRESSION
 474
 475 *lsfd* evaluates the expression passed to *--filter* option every time
 476 before printing a file line. *lsfd* prints the line only if the result
 477 of evaluation is `true`.
 478
 479 An expression consists of column names, literals and, operators like:
 480 `DELETED`, `(PID == 1)`, `(NAME == "/etc/passwd")`, `(PID == 1) && DELETED`.
 481 `DELETED`, `PID`, and `NAME` are column names in the example.
 482 `1` and "/etc/passwd" are literals.
 483 `==` and `&&` are operators.
 484
 485 Before evaluation, *lsfd* substitutes column names in the given
 486 expression with actual column values in the line. There are three
 487 different data types: `boolean`, `string`, and `number`.  For columns
 488 with a `boolean` type, the value can be stand-alone.  For `string` and
 489 `number` values, the value must be an operand of an operator, for
 490 example, `(PID == 1)`. See *OUTPUT COLUMNS* about the types of
 491 columns.
 492
 493 Literal is for representing a value directly. See BOOLLIT, STRLIT, and
 494 NUMLIT. Different data types have different literal syntax.
 495
 496 An operator works with one or two operand(s). An operator has an
 497 expectation about the data type(s) of its operands. Giving an
 498 unexpected data type to an operator causes a syntax error.
 499
 500 Operators taking two operands are `and`, `or`, `eq`, `ne`, `le`, `lt`, `ge`, `gt`, `=~`, `!~`.
 501 Alphabetically named operators have C-language
 502 flavored aliases: `&&`, `||`, `==`, `!=`, `<`, `<=`, `>=`, and `>`.
 503
 504 `!` is the only operator that takes one operand.
 505
 506 `eq`, `ne`, and their aliases expect operands have the same data type.
 507 Applying these operators return a `boolean`.
 508
 509 `and`, `or`, `not` and their aliases expect operands have `boolean` data
 510 type. Applying these operators return a `boolean`.
 511
 512 `lt`, `le`, `gt`, `ge`, and their aliases expect operands have
 513 `number` data types. Applying these operators return a `boolean`.
 514
 515 `=~` is for regular expression matching; if a string at the right side
 516 matches a regular expression at the left side, the result is true.
 517 The right side operand must be a string literal. See STRLIT about the
 518 syntax.
 519
 520 `!~` is a short-hand version of `not (STR =~ PAT)`; it inverts the
 521 result of `=~`.
 522
 523 === Limitations
 524
 525 The current implementation does not define precedences within
 526 operators.  Use `(` and `)` explicitly for grouping the
 527 sub-expressions if your expression uses more than two operators.
 528
 529 About `number` typed values, the filter engine supports only
 530 non-negative integers, and non-negative floating point numbers.
 531
 532 === Semi-formal syntax
 533
 534 //TRANSLATORS: In the following messages, translate only the <``variables``>.
 535 EXPR :: BOOLEXP
 536
 537 BOOLEXP0 :: COLUMN <``boolean``> | BOOLLIT | _(_ BOOLEXP _)_
 538
 539 BOOLEXP :: BOOLEXP0 | BOOLOP1 | BOOLOP2 | BOOLOP2BL | BOOLOP2CMP | BOOLOP2REG
 540
 541 COLUMN :: [\_A-Za-z][-_:A-Za-z0-9]*
 542
 543 BOOLOP1 :: _!_ BOOLEXP0 | _not_ BOOLEXP0
 544
 545 STREXP :: COLUMN <``string``> | STRLIT
 546
 547 NUMEXP :: COLUMN <``number``> | NUMLIT
 548
 549 BOOLLIT :: _true_ | _false_
 550
 551 CHARS  :: ( [^\] | _\\_ | _\'_ | _\"_ )*
 552
 553 STRLIT :: _'_ CHARS _'_ | _"_ CHARS _"_
 554
 555 NUMLIT :: INTLIT | FNUMLIT
 556
 557 INTLIT :: [1-9][0-9]* | _0_
 558
 559 FNUMLIT :: INTLIT _._ [0-9][0-9]*
 560
 561 BOOLOP2 :: STREXP OP2 STREXP | NUMEXP OP2 NUMEXP | BOOLEXP0 OP2 BOOLEXP0
 562
 563 OP2   :: _==_ | _eq_ | _!=_ | _ne_
 564
 565 BOOLOP2BL :: BOOLEXP0 OP2BL BOOLEXP0
 566
 567 OP2BL ::  _&&_ | _and_ |  _||_ | _or_
 568
 569 BOOLOP2CMP :: NUMEXP OP2CMP NUMEXP
 570
 571 OP2CMP :: _<_ | _lt_ | _\<=_ | _le_ | _>_ | _gt_ | _>=_ | _ge_
 572
 573 BOOLOP2REG :: STREXP OP2REG STRLIT
 574
 575 OP2REG :: _=~_ | _!~_
 576
 577 == FILTER EXAMPLES
 578
 579 *lsfd* has few options for filtering. In most of cases, what you should
 580 know is *-Q* (or *--filter*) option.  Combined with *-o* (or
 581 *--output*) option, you can customize the output as you want.
 582
 583 //TRANSLATORS: In the following messages, don't forget to add whitespace at the end!
 584 List files associated with PID 1 and PID 2 processes: ::
 585 ....
 586 # lsfd -Q '(PID == 1) or (PID == 2)'
 587 ....
 588
 589 Do the same in an alternative way: ::
 590 ....
 591 # lsfd -Q '(PID == 1) || (PID == 2)'
 592 ....
 593
 594 Do the same in a more efficient way: ::
 595 ....
 596 # lsfd --pid 1,2
 597 ....
 598
 599 Whitescapes can be used instead of a comma: ::
 600 ....
 601 # lsfd --pid '1 2'
 602 ....
 603
 604 Utilize *pidof*(1) for list the files associated with "firefox": ::
 605 ....
 606 # lsfd --pid "$(pidof firefox)"
 607 ....
 608
 609 List the 1st file descriptor opened by PID 1 process: ::
 610 ....
 611 # lsfd -Q '(PID == 1) and (FD == 1)'
 612 ....
 613
 614 Do the same in an alternative way: ::
 615 ....
 616 # lsfd -Q '(PID == 1) && (FD == 1)'
 617 ....
 618
 619 List all running executables: ::
 620 ....
 621 # lsfd -Q 'ASSOC == "exe"'
 622 ....
 623
 624 Do the same in an alternative way: ::
 625 ....
 626 # lsfd -Q 'ASSOC eq "exe"'
 627 ....
 628
 629 Do the same but print only file names: ::
 630 ....
 631 # lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u
 632 ....
 633
 634 List deleted files associated to processes: ::
 635 ....
 636 # lsfd -Q 'DELETED'
 637 ....
 638
 639 List non-regular files: ::
 640 ....
 641 # lsfd -Q 'TYPE != "REG"'
 642 ....
 643
 644 List block devices: ::
 645 ....
 646 # lsfd -Q 'DEVTYPE == "blk"'
 647 ....
 648
 649 Do the same with TYPE column: ::
 650 ....
 651 # lsfd -Q 'TYPE == "BLK"'
 652 ....
 653
 654 List files including "dconf" directory in their names: ::
 655 ....
 656 # lsfd -Q 'NAME =~ ".\*/dconf/.*"'
 657 ....
 658
 659 List files opened in a QEMU virtual machine: ::
 660 ....
 661 # lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)'
 662 ....
 663
 664 Hide files associated to kernel threads: ::
 665 ....
 666 # lsfd -Q '!KTHREAD'
 667 ....
 668
 669 List timerfd files expired within 0.5 seconds: ::
 670 ....
 671 # lsfd -Q '(TIMERFD.remaining < 0.5) and (TIMERFD.remaining > 0.0)'
 672 ....
 673
 674 == COUNTER EXAMPLES
 675
 676 Report the numbers of netlink socket descriptors and unix socket descriptors: ::
 677 ....
 678 # lsfd --summary=only \
 679         -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
 680         -C 'unix sockets':'(NAME =~ "UNIX:.*")'
 681 VALUE COUNTER
 682    57 netlink sockets
 683  1552 unix sockets
 684 ....
 685
 686 Do the same but print in JSON format: ::
 687 ....
 688 # lsfd --summary=only --json \
 689         -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \
 690         -C 'unix sockets':'(NAME =~ "UNIX:.*")'
 691 {
 692    "lsfd-summary": [
 693       {
 694          "value": 15,
 695          "counter": "netlink sockets"
 696       },{
 697          "value": 798,
 698          "counter": "unix sockets"
 699       }
 700    ]
 701 }
 702 ....
 703
 704
 705 == HISTORY
 706
 707 The *lsfd* command is part of the util-linux package since v2.38.
 708
 709 == AUTHORS
 710
 711 mailto:yamato@redhat.com[Masatake YAMATO],
 712 mailto:kzak@redhat.com[Karel Zak]
 713
 714 == SEE ALSO
 715
 716 *lsof*(8)
 717 *pidof*(1)
 718 *proc*(5)
 719 *socket*(2)
 720 *stat*(2)
 721
 722 include::man-common/bugreports.adoc[]
 723
 724 include::man-common/footer.adoc[]
 725
 726 ifdef::translation[]
 727 include::man-common/translation.adoc[]
 728 endif::[]