Skip to Content
Author's profile photo Former Member

Long-forgotten powers of the lsof command

h3. Introduction

Basically the lsof command can be used to list open files on a unix like operating system. It is thought to be used mainly by sysadmins for troubleshooting purposes. Beyond that, as on unix almost everything is a file, or at least “like” a file, you can obtain information on other things like tcp ports through lsof as well. Well lets start with some examples.

Lets get to work with an example: disp+work

The question here is: Where is the trace file of my work process? Obviously most people can instantly answer this, but the lsof approach works even if you have never seen a SAP system before. Lets get the process id of work process 0.


Ok, the pid is 17391.


We can look at the open files of a process with the -p <pid> option. Among others, we can see the kernel database library and the oracle client library Further, and this is was the initial question, we can immediately see which trace and logfiles are used. This can really be extremly helpful if you come across an application for the first time.

Example 2: sap message server port

Another question can be: On which port was the message server running again? You can answer this with lsof very easily.

The message server pid is 17366.


Everbody knew the message server runs on 36XX, but some people might just have learned that there can be 3900 (rdisp/msserv_internal) which is used for internal communication with dialog instances. And there is port 8100 (ms/server_port_0) which is an additional port for http communication.

Example 3: where does file X come from?

To conclude this blog, we look at how to find which process created a given file. Lets look at one of those cryptic job logs in the global directory. Maybe you see a file grow and grow, and you need to find out which job is causing it. Obviously to find the process the job must still be running.


We can see that work process 21545 is writing to that file. Now we can check SM50 and SM37 for the job details.


Lsof is an easy and quick way to get information on which process accesses which files / ports and vice versa. Most unixes of today have it on board.

But wait, what about windows? Well i am no windows expert by any means, but of course i wanted a lsof on win as well. You can look at the former sysinternals (now microsoft) tools process monitor and process explorer. They are free and offer lsof alike possibilities.!|height=297|alt=image|width=652|src=|border=0!</body>

Assigned Tags

      Be the first to leave a comment
      You must be Logged on to comment or reply to a post.