0

I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below:

$ lsof -p | wc -l

$ lsof -p 63589 | wc -l
960

COMMAND      PID    TID       USER   FD      TYPE             DEVICE   SIZE/OFF       NODE NAME
java       63589              ubuntu  mem       REG             202,65    5614666    8627864 /var/elasticsearch/nodes/0/indices/jetty/1/index/_2uid_Lucene41_0.tim

$ lsof -n | grep | wc -l

$ lsof -n | grep 63589 | wc -l
111268

COMMAND      PID    TID       USER   FD      TYPE             DEVICE   SIZE/OFF       NODE NAME
java       63589  12817       ubuntu  625r      REG             202,65       5014    8627698 /var/elasticsearch/nodes/0/indices/cde_api_server/1/index/_3h65.cfs
java       63589  63611       ubuntu  207u     0000                0,9          0       7413 anon_inode
java       63589  63611       ubuntu  208r     FIFO                0,8        0t0     737362 pipe

Seems if using lsof with -p, there will be no TID in result? But it should list all file descriptors of pid 63589, right?

960 vs 111268 is so huge difference, can anyone help to explain this?

Y.Huang
  • 11
  • 1

2 Answers2

0

how about U try this?

lsof -n | grep 63589 | head -100

"lsof" is list of open files. so, you can get different results at every time. But, 960 and 111268 is so huge different. Possibly, there can be process of similar PID (ex. 163589 including 63589). So check result of 'lsof -n | grep'

Jinil
  • 1
  • 2
  • I do have compared and checked *all* their differences, and have pasted in my original post in the second part on several example for the difference, all 111268 records all belongs to PID 63589, not the case as you mentioned above. That's why I think it very strange. – Y.Huang Feb 22 '16 at 11:12
0

The first command 

lsof -p 63589

will show all opened files of the process with id 63589

The second one 

lsof -n | grep 63589

will show the opened files opened by the process 63589 plus the threads (that's why TIP column is present) which the 63589 process created. Its totally normal the second command to count much more results.

Vikelidis Kostas
  • 967
  • 1
  • 6
  • 16