zlsof — Displays information about open files, sockets, and pipes

Format

zlsof [-p[pids]|[-a[asids]|[-j[jobs]] [-u[users]] [-c] [-d] [-t] [-i] [-l] [-n] [-su] [-v] [-m maxtime] [-rw[seconds]] [pathname|pipe|socket]

Description

The zlsof utility displays information about open files, sockets, and pipes (including named pipes, which are also known as FIFO special files). The display includes the file name or inode number, associated PID, user, file system, and whether the file was locked by the byte range lock manager (BRLM).

Filters are provided to limit output. Filters include specific processes, ASIDs, jobs, users, files, file systems, sockets, and pipes

The default output for an unauthorized invoker consists of open file information for processes that are associated with the user. If the invoker is authorized, the default output consists of open file information for all processes in the system.

You can also use the -rw option to monitor file system usage.

Operands

pathname|socket|pipe: If a pathname is given, only the usage of that file is listed. If pathname is a mount point, all files in use within that file system are listed.
If socket or pipe is entered, the output will show only the socket or pipe and FIFO summary usage.

Options

–p pid

PID filter: an optional list of process IDs that are separated by commas. The output will show the process IDs. -p is the default output format. For example:

-p 11,22,37

–j job

Job filter: an optional list of job names that are separated by commas. The output will show the job names. For example:

-j resolver,cea

–a asid

ASID filter: an optional list of ASIDs that are separated by commas. The output will show the ASIDs. For example:

-a 23,1d

–u user

User filter: a list of user IDs that are separated by commas. For example:

-u wjs,jhc

–c

Omits the current directory and root.

–d

Displays all deleted, but open files. This option also sets -i -s. To use this option, you must have UID=0 or be permitted to the BPX.SUPERUSER resource in the FACILITY class.

–t

Shows the tally of file types open by process.

–i

Shows the inode numbers instead of file names.

–n

Derives the real path names for files. This option is disabled after maxtime seconds (see option -m)

–su

Sets the effective UID to 0, if it is not already 0. To use this option, you must have UID=0 or be permitted to BPX.SUPERUSER resource in the FACILITY class.

–l

Indicates files with byte range locks. To use this option, you must have UID=0 or be permitted to BPX.SUPERUSER resource in the FACILITY class.

-v

Verbose mode. Prints running status and information.

-m maxatime

No longer derives the file names after maxtime seconds. The default is 60. Use this option with the -n option.

-rw

Monitors matching file systems for read and write activity for a specified time. If a length of time is not specified, 20 seconds is used. To use this option, you must have UID=0 or be permitted to BPX.SUPERUSER resource in the FACILITY class.

The output consists of two parts: First, the initial file or file system usage information that matches the input PIDs, ASIDs, jobs, users, and path name filters is displayed; second, the summary read and write activity for the corresponding file systems is provided.

Note: This option causes the command to be suspended for the specified time period while I/O counts are accumulated.

Examples

The following display shows output with a PID filter applied:

SY1:/> zlsof -p 1,2,3,16777220
zlsof 120515: Searching for all file usage by process 1,2,3,16777220
Command       PID User     File System    Mountpoint  Inode/file
BPXPINPR        1 IBMUSER  ZOS21.ROOT.HFS /           r 3
                           ZOS21.ROOT.HFS /           c 3
EZBREINI        2 RESOLVER ZOS21.ROOT.HFS /           r 3
                           ZOS21.ROOT.HFS /           c 3
EZBREUPS        3 RESOLVER ZOS21.ROOT.HFS /           r 3
                           ZOS21.ROOT.HFS /           c 3
CEAPSRVR 16777220 CEA      ZOS21.ROOT.HFS /           r 3
                           ZOS21.ROOT.HFS /           c 3
CEAPSRVR 16777220 CEA                     socket: 1
End of output

The following display illustrates output with a user filter applied.

SY1:/> zlsof -u wellie1
zlsof 120515: Searching for all file usage by user wellie1
Command       PID User    File System    Mountpoint  Inode/file
obrowse 83886089 WELLIE1  ZOS21.ROOT.HFS /           r 3
                          ZOS21.ROOT.HFS /           c 3
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
-sh     83886091 WELLIE1  ZOS21.ROOT.HFS /           r 3
                          ZOS21.ROOT.HFS /           c 3
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
                          ZOS21.ROOT.HFS /           1259 /dev/ttyp0001
                          ZOS21.ROOT.HFS /           1301 /tmp/.sh_history
OMVS    83886095 WELLIE1  ZOS21.ROOT.HFS /           r 3
                          ZOS21.ROOT.HFS /           21 tmp
                          ZOS21.ROOT.HFS /           1258 /dev/ptyp0001
                          ZOS21.ROOT.HFS /           1323 //instruct.txt

The following display lists deleted, but open, files. The -d option is used.

SY1:/> zlsof -d
zlsof 120515: Searching for all file usage for deleted files
Command       PID User    File System   Mountpoint     Size Inode/file
OMVS     83886095 WELLIE1 ZOS21.ROOT.HFS /                1 1323 //instruct.txt
End of output

Usage notes

In the output, the inode or file can be prefixed by one of the following letters:
c

Indicates the current directory for the process

r

Indicates the current root for the process.

w

This process is waiting on a byte range lock for the file.

h

This process is holding a byte range lock for the file.
If the –c option is used, lines with c and r are suppressed.
If the –l option is not used, w and h are not displayed.
The –p, –j and –a options are mutually exclusive.
If neither –n nor –i are specified, the output format will contain any portion of the file name that was retained by the system in addition to the inode number.
Use -- to separate the last option flag from the operand if the operand starts with – or the last option flag takes an optional parameter that is not specified. For example, zlsof -j pipe will filter on job name PIPE but zlsof -j -- pipe will filter on pipe and show job names in the output.
zlsof is available as a TSO/E command and a shell command. It can also be executed as a system REXX exec, using the F AXR,ZLSOF system command.

Exit values

0: The command was successfully processed.
1: A failure occurred.

Related information

fuser