On Wed, Jul 5 2023 at 08:42:23 AM +03:00:00, Michael Tokarev
<[email protected]> wrote:
Package: lsof
Version: 4.95.0-1
Severity: normal
Previously, I was able to see open but deleted files on a given
filesystem
(for example, after upgrading a library, with old .so files still
open by
older processes) by doing this:
lsof / | grep DEL
This gave output like this (after recent libX11 update):
Xwayland 1998 2007 Xwayland: mjt DEL REG 0,23 339489
/usr/lib/x86_64-linux-gnu/libX11-xcb.so.1.0.0
Xwayland 1998 2007 Xwayland: mjt DEL REG 0,23 339461
/usr/lib/x86_64-linux-gnu/libX11.so.6.4.0
But with bookworm lsof, it does not work, `lsof /' is not finding
these
DEL files anymore. It only works without the filesystem argument, eg
lsof | grep DEL
but obviously it shows far more than I wanted it to show, and works
*dramatically* slower.
It looks like something changed within lsof in the filesystem matching
That's odd, it still works for me on bookworm:
dilinger@5310:~$ lsof / |grep DEL|grep chromiu
chromium 146607 dilinger DEL REG 254,1 54575015
/home/dilinger/.config/chromium/BrowserMetrics/BrowserMetrics-64A3BB92-23CAF.pma
chromium 146607 dilinger DEL REG 254,1 54623911
/home/dilinger/.config/dconf/user
dilinger@5310:~$
What does your /proc/mounts look like? Maybe there's something
different with how your / is mounted? Or, maybe lsof lacks permission
to access something? Does it work if you run lsof / as root? Running
it under strace could also provide a hint.
