CentOS, Debian, Information, Linux Distributions, OpenSourceSoftware, Redhat, Security, SuSE, Ubuntu

…and after you upgrade, dont forget to `lsof`

BTW: Upgrading might not be enough…

After upgrading (up2date, yum, apt, …) my Linux systems, I check with lsof to see if any processes needs a restart…


Because, running processes might still be using old libraries and binaries etc, and would need a restart to use the new ones…

So… You might be vulnerable, even if you do install security updates regularly…

On older versions of lsof, I used to issue: lsof +L1|grep DEL
This does not seem to be sufficient on newer versions of lsof… Might be a bug?

After searching the web for information for an easier or better way of doing this, I found little… I even did not find any good info on the way I am used of doing it… If you have a smarter way of checking this, I would love to hear from you…

Here are some references to what I found:
* A bugzilla thread on redhat.com. It also has a script for redhat based systems.
* Debian/Ubuntu based systems comes with debian-goodies… apt-get install debian-goodies and then you can use checkrestart. Which checks for programs that needs restart 🙂

To manually check, here are some commands you can issue, depending on your version of lsof.

# lsof -n +L | grep -w DEL | egrep -v ” (/dev|/SYSV|/tmp)”
# lsof -n | grep “path inode=”
# lsof -n +L1 | egrep -w “txt|mem” | grep -v ” /SYSV”
# lsof -n +L | grep -w DEL | egrep -v ” (/dev|/SYSV|/tmp) ”

Hope you make this check a habit after updating your servers…


One thought on “…and after you upgrade, dont forget to `lsof`

  1. Some points to consider:

    To increase performance, RHEL servers run “prelink” from /etc/cron.daily/prelink, which will introduce changes in libraries and binaries. This will change checksums and inode numbers of these files. To disable prelink running, change “/etc/sysconfig/prelink”

    If you’re running “lsof” on Linux, you can add the -X switch, which will cause “lsof” to not look up network connections. This may, on a busy web server, reduce “lsof” run time from 2-3 minutes to 2-3 seconds.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s