Show the 10 largest open files

lsof / | awk '$7 > 1048576 { print $7 / 1048576 "MB", $9, $1 }' | sort -nu | tail

February 28, 2014cellojoe

Explanation

lsof / prints the currently open files in the entire filesystem (under /).

We use Awk to process the output lines. Using Awk often has this pattern:

awk FILTER { COMMANDS; ...; }

In this example the filter is $7 > 1048576 which means the value of the 7th field in the put is greater than 1048576. The 7th field in the output of lsof is SIZE/OFF, and it contains the size of the file in bytes. With our filter we get only the files bigger than 1048576 (= 1 MegaByte), and execute the commands in { ... } for those lines.

With print $7 / 1048576 "MB", $9, $1' we print 3 columns:

  • $7 / 1048576 "MB" -- the value in the 7th field, divided by 1 MB, with "MB" appended, to display the value in MegaBytes, for example "3.14MB".
  • $9 -- the NAME column in the output of lsof, which is the file path.
  • $1 -- the COMMAND column in the output of lsof, which is the name of the process holding the file open.