（2）显示指定进程所打开的文件
[root@Mr_chen ~]# lsof -c rsyslog #使用-c选项显示指定进程所打开的文件 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rsyslogd 870 root cwd DIR 253,0 4096 2 / rsyslogd 870 root rtd DIR 253,0 4096 2 / rsyslogd 870 root txt REG 253,0 396064 130951 /sbin/rsyslogd rsyslogd 870 root mem REG 253,0 27232 393534 /lib64/rsyslog/imklog.so rsyslogd 870 root mem REG 253,0 340568 393540 /lib64/rsyslog/imuxsock.so rsyslogd 870 root mem REG 253,0 65928 392495 /lib64/libnss_files-2.12.so rsyslogd 870 root mem REG 253,0 26984 393541 /lib64/rsyslog/lmnet.so rsyslogd 870 root mem REG 253,0 1921216 392479 /lib64/libc-2.12.so rsyslogd 870 root mem REG 253,0 90880 392452 /lib64/libgcc_s-4.4.7-20120601.so.1 rsyslogd 870 root mem REG 253,0 43832 392507 /lib64/librt-2.12.so rsyslogd 870 root mem REG 253,0 19536 392485 /lib64/libdl-2.12.so rsyslogd 870 root mem REG 253,0 142640 392503 /lib64/libpthread-2.12.so rsyslogd 870 root mem REG 253,0 88600 392529 /lib64/libz.so.1.2.3 rsyslogd 870 root mem REG 253,0 154520 392472 /lib64/ld-2.12.so rsyslogd 870 root 0u unix 0xffff880037d8b6c0 0t0 8910 /dev/log rsyslogd 870 root 1w REG 253,0 501224 262654 /var/log/messages rsyslogd 870 root 2w REG 253,0 5164 262655 /var/log/secure rsyslogd 870 root 3r REG 0,3 0 4026532040 /proc/kmsg rsyslogd 870 root 4w REG 253,0 18512 262652 /var/log/cron（3）显示指定进程号说打开的文件
[root@Mr_chen ~]# lsof -p 870 #使用-p选项显示指定进程号所打开的文件 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rsyslogd 870 root cwd DIR 253,0 4096 2 / rsyslogd 870 root rtd DIR 253,0 4096 2 / rsyslogd 870 root txt REG 253,0 396064 130951 /sbin/rsyslogd rsyslogd 870 root mem REG 253,0 27232 393534 /lib64/rsyslog/imklog.so rsyslogd 870 root mem REG 253,0 340568 393540 /lib64/rsyslog/imuxsock.so rsyslogd 870 root mem REG 253,0 65928 392495 /lib64/libnss_files-2.12.so rsyslogd 870 root mem REG 253,0 26984 393541 /lib64/rsyslog/lmnet.so rsyslogd 870 root mem REG 253,0 1921216 392479 /lib64/libc-2.12.so rsyslogd 870 root mem REG 253,0 90880 392452 /lib64/libgcc_s-4.4.7-20120601.so.1 rsyslogd 870 root mem REG 253,0 43832 392507 /lib64/librt-2.12.so rsyslogd 870 root mem REG 253,0 19536 392485 /lib64/libdl-2.12.so rsyslogd 870 root mem REG 253,0 142640 392503 /lib64/libpthread-2.12.so rsyslogd 870 root mem REG 253,0 88600 392529 /lib64/libz.so.1.2.3 rsyslogd 870 root mem REG 253,0 154520 392472 /lib64/ld-2.12.so rsyslogd 870 root 0u unix 0xffff880037d8b6c0 0t0 8910 /dev/log rsyslogd 870 root 1w REG 253,0 501224 262654 /var/log/messages rsyslogd 870 root 2w REG 253,0 5164 262655 /var/log/secure rsyslogd 870 root 3r REG 0,3 0 4026532040 /proc/kmsg rsyslogd 870 root 4w REG 253,0 18512 262652 /var/log/cron（4）监听指定的协议，端口和主机等信息，显示符合条件的进程信息
在讲解范例之前，我们先来看看相应语法格式：
lsof -i [46] [protocol] [@hostname] [:service|port]
其中各项的含义如下：
[x] 46:4代表IPv4，6代表IPv6
[x] protocol:传输协议，可以是TCP或UDP
[x] hostname:主机名称或者IP地址
[x] service:进程的服务名，例如NFS，SSH和FTP等。
[x] port:系统中与服务对应的端口号。例如HTTP服务默认对应的端口号为80，SSH服务默认对应的端口号为22.
[root@Mr_chen ~]# lsof -i #查看所有进程 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 885 root 3u IPv4 8948 0t0 TCP *:ssh (LISTEN) sshd 885 root 4u IPv6 8950 0t0 TCP *:ssh (LISTEN) sshd 918 root 3r IPv4 9075 0t0 TCP localhost:ssh->localhost:54216 (ESTABLISHED) [root@Mr_chen ~]# lsof -i tcp #显示所有tcp网络连接的进程信息 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 885 root 3u IPv4 8948 0t0 TCP *:ssh (LISTEN) sshd 885 root 4u IPv6 8950 0t0 TCP *:ssh (LISTEN) sshd 918 root 3r IPv4 9075 0t0 TCP localhost:ssh->localhost:54216 (ESTABLISHED) [root@Mr_chen ~]# lsof -i:22 #显示端口为22的进程，这条命令很常用 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 885 root 3u IPv4 8948 0t0 TCP *:ssh (LISTEN) sshd 885 root 4u IPv6 8950 0t0 TCP *:ssh (LISTEN) sshd 918 root 3r IPv4 9075 0t0 TCP localhost:ssh->localhost:54216 (ESTABLISHED) [root@Mr_chen ~]# lsof -i tcp:22 #显示同时满足TCP和端口为22的进程 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 885 root 3u IPv4 8948 0t0 TCP *:ssh (LISTEN) sshd 885 root 4u IPv6 8950 0t0 TCP *:ssh (LISTEN) sshd 918 root 3r IPv4 9075 0t0 TCP localhost:ssh->localhost:54216 (ESTABLISHED)