2

In my experience, files that have the file descriptor of txt in lsof output are the executable file itself and shared objects. The lsof man page says that it means "program text (code and data)".

While debugging a problem, I found a large number of data files (specifically, ElasticSearch database index files) that lsof reported as txt. These are definitely not executable files. The process was ElasticSearch itself, which is a java process, if that helps point someone in the right direction.

I want to understand how this process is opening and using these files that gets it to be reported in this way. I'm trying to understand some memory utilization, and I suspect that these open files are related to some metrics I'm seeing in some way.

The system is Solaris 10 x86.

wfaulk
  • 6,878
  • 7
  • 46
  • 75
  • 1
    To track down whatever problem you're pursuing I'm not sure I would use `lsof` on Solaris. That command is something of a hack on Solaris which is why it isn't included in the OS by default. The true alternatives on Solaris would be `pfiles` command and DTrace. Using the latter you can monitor for example file operations in real time. – unixhacker2010 Nov 02 '13 at 11:03

1 Answers1

2

On Solaris, everything that is mapped into the memory space of the process will be listed by lsof as txt, regardless of being the started executable, or an executable shared object mapped by ld.so, or any data file mapped directly by the application.

On Linux, only the started executable will be listed as txt, everything else mapped into the memory space will be shown as mem (both executable shared objects and data files).

Laszlo Valko
  • 591
  • 6
  • 8
  • Interesting. The `lsof` documentation says that `mmap()`ed files will be reported as `mem`, but [a quick test program](http://pastebin.com/fPPTVrAH) shows me that [that's not the case](http://pastebin.com/C2ZKpLQD). – wfaulk Oct 23 '13 at 22:58
  • Specifically, `mmap()`ed files that still have a file descriptor open are referenced by that file descriptor and `mmap()`ed files whose file descriptors have been closed are reported as `txt`. – wfaulk Oct 23 '13 at 23:04