I'm using lsof to list open files on a SUSE Linux 10.0 box and in the process of doing so I noticed that it looks like lsof does not list all open files. For example, I know I have a .jpg file open by eye of gnome but when I type 'lsof | grep .jpg' nothing is returned. If I type 'ps -ef |grep eog' then I see eog file:///home/me/data/pictures/pic01.jpg'.

Why doesn't lsof itself list the .jpg file as being open??

Thanks for your help.

Weird. If I open (manually from a term) a JPEG in eog it shows in both "lsof -n|grep .jpg" and "pgrep -lf .jpg" output.

(1) Are you running the lsof command as the userid that has the file open, or as root? Other userids would not see it listed otherwise.

(2) I don't know how eog works down in the details. Could it possibly open the file, read it into memory, and then close the file - even though the file is still being displayed from it's memory image? This behavior could depend on file size, available memory, etc. It could vary from system to system, from file to file, and be dependent on system memory load at the time you did your test. I'm just speculating - I don't know the inner workings of eog.

Yeah it is weird. I'm doing the same thing and it doesn't show up. Just wondered if it was expected behavior or not, but I would think that it should show up and your experience would seem to verify that. Hmmmm.

I am running the lsof command as root. I've also tried as the user who has the file open with the same results. I don't think it's just eog that has the problem. lsof on my box doesn't ever seem to list any type of graphics format .gif, .jpg, etc. regardless of the process that has it open?? I think it's strange but don't know much about lsof and how it works. Was wondering if I was doing something wrong?

Thanks for replying.

Interesting. Could you post output of "uname -r" and "lsof -v"? Below "/some/dir/some/image.jpg" refers to the image you want to open. Open an xterm, Kterm or whatever terminal you use and do "eog /some/dir/some/image.jpg". Then run these commands from another term and post the output of (/tmp/eog.log): "lsof -n -a +D /some/dir/some 2>&1|tee -a /tmp/eog.log" and "strace -v eog /some/dir/some/image.jpg 2>&1|grep /some/dir/some/|tee -a /tmp/eog.log".

Output of "uname -r": 2.6.13-15.8-smp

Output of "lsof -v":
lsof version information:
revision: 4.75
latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
constructed: Fri Sep 9 16:06:17 UTC 2005
constructed by and on: abuild@janacek
compiler: cc
compiler version: 4.0.2 20050901 (prerelease) (SUSE Linux)
compiler flags: -DLINUXV=26012 -DGLIBCV=203 -DHASIPv6 -D_FILE_OFFSET_BITS=64 -DLSOF_VSTR="2.6.12" -O2 -march=i586 -mtune=i686 -fmessage-length=0 -Wall -D_FORTIFY_SOURCE=2 -g -Wall -Wno-unused
loader flags: -L./lib -llsof
system info: Linux janacek 2.6.12 #1 SMP Tue Sep 6 12:59:22 UTC 2005 i686 athlon i386 GNU/Linux
Anyone can list all files.
/dev warnings are disabled.
Kernel ID check is disabled.

Output of eog.log:

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
bash 6298 jcrow cwd DIR 8,2 112 67524 /home/jcrow/Documents/
eog 7938 jcrow cwd DIR 8,2 112 67524 /home/jcrow/Documents/
execve("/opt/gnome/bin/eog", ["eog", "/home/jcrow/Documents/full_wall."...], ["LESSKEY=/etc/lesskey.bin", "MANPATH=/usr/local/man:/usr/shar"..., "INFODIR=/usr/local/info:/usr/sha"..., "NNTPSERVER=news", "SSH_AGENT_PID=6141", "HOSTNAME=linux", "XKEYSYMDB=/usr/X11R6/lib/X11/XKe"..., "GNOME2_PATH=/usr/local:/opt/gnom"..., "DESKTOP_STARTUP_ID=", "TERM=xterm", "SHELL=/bin/bash", "HOST=linux", "HISTSIZE=1000", "PROFILEREAD=true", "STYLE=Industrial", "GTK_RC_FILES=/etc/opt/gnome/gtk/"..., "WINDOWID=52435079", "QTDIR=/usr/lib/qt3", "XSESSION_IS_UP=yes", "USER=jcrow", "JRE_HOME=/usr/lib/jvm/jre", "GROFF_NO_SGR=yes", "DESKTOP_LAUNCH=gnome-open", "LS_COLORS=no=00:fi=00:di=01;34:l"..., "GNOME_ICON_PATH=/usr/share/image"..., "OPENWINHOME=/usr/openwin", "XNLSPATH=/usr/X11R6/lib/X11/nls", "GNOME_KEYRING_SOCKET=/tmp/keyrin"..., "SSH_AUTH_SOCK=/tmp/ssh-OnAQe6090"..., "HOSTTYPE=i386", "KDEDIR=/opt/kde3", "SESSION_MANAGER=local/linux:/tmp"..., "USERNAME=jcrow", "FROM_HEADER=", "PAGER=less", "XDG_CONFIG_DIRS=/usr/local/etc/x"..., "MINICOM=-c on", "DESKTOP_SESSION=gnome", "PATH=/home/jcrow/bin:/usr/local/"..., "CPU=i686", "JAVA_BINDIR=/usr/lib/jvm/jre/bin"..., "GDM_XSERVER_LOCATION=local", "PWD=/home/jcrow", "INPUTRC=/etc/inputrc", "XMODIFIERS=@im=local", "JAVA_HOME=/usr/lib/jvm/jre", "LANG=en_US.UTF-8", "PYTHONSTARTUP=/etc/pythonstart", "KDEDIRS=/opt/gnome/share/dist/kd"..., "STAFHome=/usr/local/staf", "GDMSESSION=gnome", "SSH_ASKPASS=/usr/lib/ssh/x11-ssh"..., "TEXINPUTS=:::/home/jcrow/.TeX:/u"..., "HOME=/home/jcrow", "SHLVL=1", "OSTYPE=linux", "LESS_ADVANCED_PREPROCESSOR=no", "GNOME_DESKTOP_SESSION_ID=Default"..., "XCURSOR_THEME=Industrial", "LS_OPTIONS=-N --color=tty -T 0", "WINDOWMANAGER=/usr/bin/dbus-laun"..., "GTK_PATH=/usr/local/lib/gtk-2.0:"..., "LOGNAME=jcrow", "MACHTYPE=i686-suse-linux", "LESS=-M -I", "CVS_RSH=ssh", "ACLOCAL_FLAGS=-I /opt/gnome/shar"..., "XDG_DATA_DIRS=/usr/local/share/:"..., "DBUS_SESSION_BUS_ADDRESS=unix:ab"..., "LESSOPEN=lessopen.sh %s", "PKG_CONFIG_PATH=/usr/local/lib/p"..., "INFOPATH=/usr/local/info:/usr/sh"..., "DISPLAY=:0.0", "LESSCLOSE=lessclose.sh %s %s", "G_BROKEN_FILENAMES=1", "XAUTHORITY=/home/jcrow/.Xauthori"..., "COLORTERM=gnome-terminal", "JAVA_ROOT=/usr/lib/jvm/jre", "_=/usr/bin/strace", "OLDPWD=/tmp"]) = 0
lstat64("/home/jcrow/Documents/full_wall.jpg", {st_dev=makedev(8, 2), st_ino=148638, st_mode=S_IFREG|0644, st_nlink=1, st_uid=1000, st_gid=100, st_blksize=4096, st_blocks=64, st_size=31673, st_atime=2006/05/30-10:57:43, st_mtime=2006/05/30-10:50:33, st_ctime=2006/05/30-10:50:33}) = 0
write(1, " 1 /home/jcrow/Documents/full_w"..., 51 1 /home/jcrow/Documents/full_wall.jpg (1024/768)
stat64("/home/jcrow/Documents/full_wall.jpg", {st_dev=makedev(8, 2), st_ino=148638, st_mode=S_IFREG|0644, st_nlink=1, st_uid=1000, st_gid=100, st_blksize=4096, st_blocks=64, st_size=31673, st_atime=2006/05/30-11:01:03, st_mtime=2006/05/30-10:50:33, st_ctime=2006/05/30-10:50:33}) = 0
write(14, "-\0\1\0\3\0\1\0#\0/home/jcrow/Documents/"..., 45) = 45

OK. Your version of lsof is kinda recent. Good.


eog 7938 jcrow cwd DIR 8,2 112 67524 /home/jcrow/Documents/
Output of requested command "eog /some/dir/some/image.jpg" looks weird. It doesn't show the actual image but the directory it's in. I can't see from here if that's due to how you executed the command or if it's an Eog preference.
The exec and stat lines show no errors, but I don't see an open() line where the image is actually opened. Weird.
Only think I can think of would be to try compile lsof from source for your kernel.