lsof and permission issues

ChrisRHS · 12-21-2009, 08:36 PM

Hello everyone!

I am hoping someone can help me out here. I've got a strange issue on one of my servers, that I am having trouble tracking down. It started with a higher than normal load this morning, so, I started tracing things out. I wanted to look an apache process that seemed to be hanging around for too long. So, I typed :

Code:

lsof -p pid

And all I got was things of this nature:

Code:

httpd 10625 nobody 175 unknown /proc/10625/fd/175 (readlink: Permission denied)

Now, I am logged in as the super user, and I am baffled as to why I am getting permission errors. I've looked at this on a couple of other servers, and it works as is should. This system us running CentOS 5.4, with cPanel.

Has anyone run across this before and may be able to add some input?

Thanks
Chris

colucix · 12-22-2009, 04:07 PM

I never encountered this problem, but looking at the lsof FAQ maybe this is relevant to your issue:

Code:

10.5.2  What does ``(readlink: xxx)'' mean in the NAME column of
	Linux files?

	When lsof tried to convert the /proc/<PID>/fd path, reported in
	the NAME column, to its full and more meaningful path, the
	readlink(2) system call used to do the conversion failed.  The
	readlink(2) failure message is ``xxx''.

	This situation usually occurs if the lsof process lacks
	permission to readlink(2) some part of the path -- e.g., the
	lsof executable lacks root permission, or lsof is attempting to
	stat(2) a path on an NFS device mounted with the root_squash
	option.

	The message can be suppressed with lsof's ``-w'' option.

In any case, as root can you change to /proc/10625/fd directory and issue the command

Code:

readlink 175

from there? I mean, does it still give a permission denied error?