1

I am trying to troubleshoot an issue and whenever I do lsof, I see that a process is eating up this one file. This file is mentioned 12x in the output, it has everything same (path, size, PID, and node) but the only difference is FD.

Does anyone know if this is normal? why does output showing this file open in multiple lines with different FD but everything else same?

Here output:

COMMAND       PID  USER   FD  TYPE    DEVICE    SIZE/OFF      NODE   NAME Path

php         14234  root  12r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 21)
php         14234  root  17r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 29)
php         14234  root  21r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 36)
php         14234  root  27r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 43)
Improve this question
2
  • Could it simply be that this process has the file open multiple times? If possible, edit your question to include the relevant part of lsof's output. Commented Oct 13, 2017 at 16:54
  • I put an example of the output. I only put 4 of them, but it is mentioned total of 12 times in the lsof output. Commented Oct 13, 2017 at 17:05

1 Answer 1

Reset to default
1

From the output you posted, it looks like the php process with PID 14234 is running as root, and indeed has the kMiles file open several times, as the differing FDs indicate.

If this has unexpected elements (the file name, PHP running as root), this could indicate a compromised server, but the output from lsof itself makes sense.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.