lsof / | awk '$7 > 1048576 { print $7 / 1048576 "MB", $9, $1 }' | sort -nu | tail
lsof /
prints the currently open files in the entire filesystem (under /
).
We use Awk to process the output lines. Using Awk often has this pattern:
awk FILTER { COMMANDS; ...; }
In this example the filter is $7 > 1048576
which means the value of the 7th field in the put is greater than 1048576. The 7th field in the output of lsof
is SIZE/OFF
, and it contains the size of the file in bytes. With our filter we get only the files bigger than 1048576 (= 1 MegaByte), and execute the commands in { ... }
for those lines.
With print $7 / 1048576 "MB", $9, $1'
we print 3 columns:
$7 / 1048576 "MB"
-- the value in the 7th field, divided by 1 MB, with "MB" appended, to display the value in MegaBytes, for example "3.14MB".$9
-- the NAME
column in the output of lsof
, which is the file path.$1
-- the COMMAND
column in the output of lsof
, which is the name of the process holding the file open.