查看 lsof 输出时，“0t0”是什么意思？

Question

查看 lsof 输出时，“0t0”是什么意思？

Answer 1

由于您没有提供有关您在哪里看到的任何信息，我将假设您在运行 GNUlsof时没有任何参数，并且您会0t0在SIZE/OFF专栏中看到。默认情况下，这会显示相关文件的大小。

但是，对于“特殊”文件，它会给出偏移量。从lsof 手册页：

SIZE, SIZE/OFF, or OFFSET
   is the size of the file or the file offset in bytes. A value is displayed in
   this column only if it is available. Lsof displays whatever value - size or 
   offset - is appropriate for the type of the file and the version of lsof. 
On some UNIX dialects
    lsof can't obtain accurate or consistent file offset information from its
    kernel data sources, sometimes just for particular kinds of files (e.g., 
   socket files.) In other cases, files don't have true sizes - e.g., sockets, 
   FIFOs, pipes - so lsof displays for their sizes the content amounts it finds in 
   their kernel buffer descriptors (e.g., socket buffer size counts or TCP/IP 
   window sizes.) Consult the lsof FAQ (The FAQ section gives its location.) for 
   more information. 
The file size is displayed in decimal;
    the offset is normally displayed in decimal with a leading ''0t'' if it 
   contains 8 digits or less; in hexadecimal with a leading ''0x'' if it is 
   longer than 8 digits. (Consult the -o o option description for information 
   on when 8 might default to some other value.) 
Thus the leading ''0t'' and ''0x'' identify an offset when the column
    may contain both a size and an offset (i.e., its title is SIZE/OFF). 

换句话说，0t表示十进制表示法并表示十进制表示法中0t0大小为 0 的文件。您可以通过查看具有该大小的文件来确认（这是在 Debian 机器上运行的）：

lsof | grep 0t0 | awk '{print $(NF-2),$NF}' | sort -u

您将看到具有该报告大小的所有文件都将是套接字、管道、打开的 TCP 连接、设备等内容。