Search code examples
linuxawklsof

lsof open files count not same

I want to know the count of opened files of each process so I use the lsof command with:

lsof -n | awk '{print $2}'|sort |uniq -c |sort -nr| more

And I found a process with pid "934" opened 11374 files but when I use 

lsof -p 934 | wc -l

it is wired that the result shows that it only opened 122 files.

The following images shows the command I used.

enter image description here

Solution

  • Why the two counts are different?

    Reason one:

    lsof generates a header, it was counted in your lsof -p xxx, however, in your awk filtering, it was filtered out (header has no $2==pid), so the count must be different. However we see the difference is >>1, so reason two comes.

    Reason two: (the main reason)

    lsof will default always output thread id (TID read man page for details). However, if you add -p xxx, only process opened files are listed, without TID.

    If you want to prove it, try this two lines:

    lsof -p somePid|wc -l

    And

    lsof|awk '$2==somePid||NR==1'|wc -l

    The output should be same.

    You should customize the output format, to reach your goal.