Get list of open files (descriptors) in OS X

E

9

93

I would like to get a list of open files in a process on os x (10.9.1). In Linux I was able to get this from /proc/PID/fd. However I'm not sure how to get the same on OS X. I found that the procfs is not present on the OS X (by default. possible implementations present, but I do not want to go that way).

So how do I get (natively) the list of open files in a process on OS X. One way is lsof. is there any other support available? please let me know where I can get more info on this.

Thanks.

Erective answered 7/1, 2014 at 14:40 Comment(1)

lsof is the presumptive answer to the question in the title itself. Would you consider making the title more specific? – Durban 16/5, 2017 at 22:7

C

60

At least on OSX 10.10 (Yosemite, didn't check on Mavericks), you can get the list of open files by process via the default activity monitor application. Just double click on the relevant process on the list and select "Open Files and Ports" tab on the popup.

Tip: cmd+f shortcut on that pane allows for searching and highlighting on the content.

Centripetal answered 11/11, 2014 at 10:45 Comment(2)

It works only for the processes you own. For all others you'd still need to use lsof. – Richmond 24/9, 2018 at 21:10

In Big Sur, at least, Activity Monitor has a menu option View -> "All processes" that seems to work. My user is local admin on the mac though. – Oath 17/3, 2021 at 3:29

H

102

I had a hard time getting Activity Monitor to show open files for a process that was running as root (via sudo). The original question mentions lsof, and it does the trick exactly. If you know the process name or PID, it's super quick.

Find processes by name:

lsof -c processname

Find processes by PID:

lsof -p 123

(Prefix with sudo as needed, such as if you are not the owner of the process.)

Hexapla answered 2/8, 2016 at 23:45 Comment(0)

C

60

At least on OSX 10.10 (Yosemite, didn't check on Mavericks), you can get the list of open files by process via the default activity monitor application. Just double click on the relevant process on the list and select "Open Files and Ports" tab on the popup.

Tip: cmd+f shortcut on that pane allows for searching and highlighting on the content.

Centripetal answered 11/11, 2014 at 10:45 Comment(2)

It works only for the processes you own. For all others you'd still need to use lsof. – Richmond 24/9, 2018 at 21:10

In Big Sur, at least, Activity Monitor has a menu option View -> "All processes" that seems to work. My user is local admin on the mac though. – Oath 17/3, 2021 at 3:29

M

14

This works for some things:

sudo fs_usage | grep dev

for /dev/ files or similar.

Microtone answered 5/12, 2015 at 4:44 Comment(0)

P

9

The clean and simple approach to inspect the current process (i.e. the equivalent of /proc/self/fd on Linux) is to use ls /dev/fd/:

e.g.

$ touch "file"
$ exec 3<>file

$ ls /dev/fd/    

0 1 2 3

Pretonic answered 27/2, 2017 at 10:14 Comment(3)

Is there a way to access this for a process other than the current one? – Grapeshot 6/3, 2017 at 2:59

@CharlesDuffy – I am not sure exactly; I reworded my answer. – Pretonic 6/3, 2017 at 14:55

web.archive.org/web/20190724030849/http://osxbook.com/book/… – Fulguration 4/9, 2021 at 8:59

P

7

List open files on /Volumes/VolumeName:

lsof | grep "/Volumes/VolumeName"

Psychogenic answered 23/5, 2018 at 7:43 Comment(2)

Or rather: lsof "/Volumes/VolumeName" – Beery 1/5, 2020 at 15:37

You can filter by pid using lsof -p pid or negate that pid passing -p ^pid and getting everything except those opened by pid. – Adularia 4/7, 2020 at 20:55

I

4

"You can get the list of open files by process via the default activity monitor application. Just double click on the relevant process on the list and select "Open Files and Ports" tab on the popup." But "you had a hard time getting Activity Monitor to show open files for a process that was running as root (via sudo) or others user".

So just run Active Monitor by sudo, that`s it

sudo /Applications/Utilities/Activity\ Monitor.app/Contents/MacOS/Activity\ Monitor

Internecine answered 20/7, 2020 at 16:53 Comment(1)

Good to create alias for this. – Kerf 11/8, 2022 at 11:58

M

2

I use the What's Open application that is very handfull (with filters, disk selection, ...).

You can find it there : http://whatsopen.en.softonic.com/mac.

Melentha answered 8/1, 2014 at 16:36 Comment(1)

There's also a later releases not on softonic: apps.tempel.org/WhatsOpen. Also the source for the v4 is at github.com/tempelmann/whatsopen. – Overfeed 6/8, 2023 at 18:58

H

2

Since you asked "Is there any other support [than lsof] available?", try this:

Create a command line tool using the "proc_pidinfo" C API referenced in the selected answer to this question: How can I programmatically get the list of open file descriptors for a given PID on OS X?

You can use proc_pidinfo with the PROC_PIDLISTFDS option to enumerate the files used by a given process. You can then use proc_pidfdinfo on each file in turn with the PROC_PIDFDVNODEPATHINFO option to get its path.

Hugo answered 7/10, 2017 at 15:36 Comment(0)

S

0

lsof -c /^74016$/ -d^txt -FcfadDtns0

The -F instructs lsof to produce output suitable for consumption by another process, such as Perl or awk. In man lsof search for OUTPUT FOR OTHER PROGRAMS for details. The characters that come after -F represent a field you want to select for output. The output then puts each of these characters in front of the respective field. Example output:

p212^@cloginwindow^@
fcwd^@a ^@tDIR^@D0x1000004^@s704^@n/^@
f0^@ar^@tCHR^@D0xf218cacb^@n/dev/null^@
f1^@au^@tCHR^@D0xf218cacb^@n/dev/null^@
f2^@au^@tCHR^@D0xf218cacb^@n/dev/null^@
f3^@ar^@tREG^@D0x1000004^@s216424^@n/Library/Application Support/CrashReporter/SubmitDiagInfo.domains^@
f4^@ar^@tREG^@D0x1000004^@s77^@n/private/etc/security/audit_user^@
f5^@ar^@tREG^@D0x1000004^@s652^@n/private/etc/security/audit_class^@
f6^@ar^@tREG^@D0x1000004^@s358^@n/private/etc/security/audit_control^@
f7^@ar^@tREG^@D0x1000004^@s111033^@n/System/Library/Frameworks/CoreImage.framework/Versions/A/Resources/ci_stdlib.metallib^@
f8^@au^@tIPv4^@d0xc401abd77f1dd1d9^@n*:*^@
f9^@ar^@tREG^@D0x1000004^@s308316^@n/System/Library/Frameworks/CoreImage.framework/Versions/A/Resources/ci_filters.metallib^@
f10^@au^@tREG^@D0x1000004^@s1536^@n/private/var/folders/4g/3lkhwv6n7_76_1s8snscvhxc0000gp/C/com.apple.loginwindow/com.apple.metal/3902/libraries.maps^@
f11^@au^@tREG^@D0x1000004^@s65536^@n/private/var/folders/4g/3lkhwv6n7_76_1s8snscvhxc0000gp/C/com.apple.loginwindow/com.apple.metal/3902/libraries.data^@
f12^@au^@tREG^@D0x1000004^@s1536^@n/private/var/folders/4g/3lkhwv6n7_76_1s8snscvhxc0000gp/C/com.apple.loginwindow/com.apple.metal/Intel(R) HD Graphics 630/functions.maps^@
f13^@au^@tREG^@D0x1000004^@s131072^@n/private/var/folders/4g/3lkhwv6n7_76_1s8snscvhxc0000gp/C/com.apple.loginwindow/com.apple.metal/Intel(R) HD Graphics 630/functions.data^@
p421^@ccoreauthd^@
fcwd^@a ^@tDIR^@D0x1000004^@s704^@n/^@
f0^@ar^@tCHR^@D0xf218cacb^@n/dev/null^@
f1^@au^@tCHR^@D0xf218cacb^@n/dev/null^@
f2^@au^@tCHR^@D0xf218cacb^@n/dev/null^@
p537^@cUserEventAgent^@
fcwd^@a ^@tDIR^@D0x1000004^@s704^@n/^@
f0^@ar^@tCHR^@D0xf218cacb^@n/dev/null^@
f1^@au^@tCHR^@D0xf218cacb^@n/dev/null^@
f2^@au^@tCHR^@D0xf218cacb^@n/dev/null^@
f3^@au^@tunix^@d0xc401abd77b9c8579^@n->0xc401abd77b9c8709^@
f4^@au^@tunix^@d0xc401abd77b9c7129^@n->0xc401abd77b9c8899^@

Seidule answered 11/3, 2021 at 13:46 Comment(0)

Recommended topics

Hot tags