how to check open file without lsof

Question

In linux, I use lsof to check the file is opened by which process. I have an android device, but no lsof command. Is it possible to find which process open the specific file ?

I will use it to verify the MediaPlayer hold a fd, but it should be closed.

'lsof' is added to [ICS](http://androidxref.com/source/history/system/core/toolbox/Android.mk), commit `8b9b105bc7bf6428591d55462b3e727ba7504b29`. Lift it from the source, rip out the required bits and build it using the NDK if it doesn't exist on the versions you are targeting. — Jens, May 29 '12 at 10:14

score 33 · Accepted Answer · answered Feb 25 '13 at 13:15

33

Poor man's lsof is to execute

ls -l  /proc/[process id]/fd

Still, you need to be root.

answered Feb 25 '13 at 13:15

johsin18

838
7
10

19

`ls -l /proc/*/fd` to see all open files like lsof does by default. – mike jones Oct 22 '13 at 08:18

score 9 · Answer 2 · answered Sep 21 '15 at 23:40

9

Thanks mike jones and Joqn for the tip with poor man's lsof. I used it in the following on busybox (synology nas) to list the fd directories grouped under each process:

  for p in [0-9]*; do ls -l /proc/$p/fd ;done

answered Sep 21 '15 at 23:40

rob451

91
1
1

2

Thanks. Looks like this needs to be run inside the /proc folder - maybe it should more generally be `for p in /proc/[0-9]*; do ls -l $p/fd; done`? – mwfearnley Dec 12 '18 at 13:30

score 1 · Answer 3 · answered May 29 '12 at 09:20

1

Install busybox, it has a lsof command.

answered May 29 '12 at 09:20

Nikolay Elenkov

52,576
10
84
84

I used busy box but still im getting "????" how can i get the values is it a different command by any chance ?? – wam090 Dec 19 '12 at 16:44
im already on root access , the command runs and give out a table and im expecting values , but all what im getting is Question marks "????" any ideas thanx – wam090 Dec 19 '12 at 17:02
I installed Busybox on my phone, but it does not provide me the lsof command :-( Maybe this is phone-specific, but I don't find it in the applet list. – johsin18 Feb 25 '13 at 13:14
1

There are statically linked busybox binaries for most architectures here: http://busybox.net/downloads/binaries/latest/ – dequis Mar 24 '14 at 08:42

score 1 · Answer 4 · answered Dec 16 '20 at 09:48

Combining the above /proc based with the answers to this question about searching a directory tree for symlinks gives the following:

# find /proc -ignore_readdir_race -name task -prune -o -path '*/fd/*' -lname '/file/of/interest' -ls -quit
 37023    0 l-wx------   1 username  username        64 Dec 16 09:06 /proc/4140/fd/1 -> /file/of/interest

The -ignore_readdir_race avoids errors due to short lived processes, the -prune gets rid of task level results (not strictly necessary when stopping at the first process, since those paths would still give the same answer, but useful to avoid redundancy in other use cases, like listing all the results)

Combine -print with cut to extract the pid directly:

# find /proc -ignore_readdir_race -name task -prune -o -path '*/fd/*' -lname '/file/of/interest' -print -quit | cut -d / -f 3
4140

Once you have the pid, you can use ps to get the process details (as per the answers to this SuperUser question):

# ps -p 4140 -o command=
/some/command --with=some args

(Note, I tested this on Linux, and it should work the same on BSD, but I'm not 100% sure about Android)

how to check open file without lsof

4 Answers4

Linked