pfiles - Man Page

pfiles [-n] [pid | core]...

Print fstat(2) and fcntl(2) information for all open files in each process or process core file. For network endpoints, provide local address information and peer address information when connected. For sockets, provide the socket type, socket options, and send and receive buffer sizes. Also print a path to the file when that information is available from /proc/pid/fd. This is not necessarily the same name used to open the file. In addition, print the current soft and hard RLIMIT_NOFILE limits and the process umask. See proc(5) for more information.

-n

Set non-verbose mode. Do not display verbose information for each file descriptor. Instead, limit output to the information that the process would retrieve by applying fstat(2) to each of its file descriptors.

pid

Process ID list. A /proc/pid path may also be used, allowing shell expansions like /proc/* to target all processes on the system.

core

Process core file, as produced by systemd-coredump(8), or an Ubuntu/Debian apport .crash file. For systemd core files, the file does not need to exist on disk; if it has been removed, the corresponding systemd journal entry will be used instead. See Notes below.

0 on success, non-zero if an error occurs (such as no such process, permission denied, or invalid option).

/proc/pid/*

Process information and control files.

When a core file has been removed by systemd-tmpfiles(8) or by storage limits configured in coredump.conf(5), the systemd-coredump(8) journal entry for the crash may still be available. In this case, the path to the deleted core file can be passed as the core operand even though the file no longer exists on disk, and process metadata will be retrieved from the journal entry instead. Use coredumpctl(1) to obtain the path of a missing core file, e.g., coredumpctl list <name> -F COREDUMP_FILENAME.

Ubuntu/Debian apport .crash files are also supported. These files use Debian control syntax with base64-encoded gzip core dumps. Text fields (such as ProcCmdline, ProcEnviron, and ExecutablePath) are mapped to COREDUMP_* fields, and the core dump is extracted on first access.

fstat(2), fcntl(2), coredumpctl(1), proc(5)

pcred(1).