Why big difference between `lsof -p | wc -l` and `lsof | grep | wc -l`

lsof

I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below:

$ lsof -p | wc -l

$ lsof -p 63589 | wc -l
960

COMMAND      PID    TID       USER   FD      TYPE             DEVICE   SIZE/OFF       NODE NAME
java       63589              ubuntu  mem       REG             202,65    5614666    8627864 /var/elasticsearch/nodes/0/indices/jetty/1/index/_2uid_Lucene41_0.tim

$ lsof -n | grep | wc -l

$ lsof -n | grep 63589 | wc -l
111268

COMMAND      PID    TID       USER   FD      TYPE             DEVICE   SIZE/OFF       NODE NAME
java       63589  12817       ubuntu  625r      REG             202,65       5014    8627698 /var/elasticsearch/nodes/0/indices/cde_api_server/1/index/_3h65.cfs
java       63589  63611       ubuntu  207u     0000                0,9          0       7413 anon_inode
java       63589  63611       ubuntu  208r     FIFO                0,8        0t0     737362 pipe

Seems if using lsof with -p, there will be no TID in result? But it should list all file descriptors of pid 63589, right?

960 vs 111268 is so huge difference, can anyone help to explain this?

Best Answer

how about U try this?

lsof -n | grep 63589 | head -100

"lsof" is list of open files. so, you can get different results at every time. But, 960 and 111268 is so huge different. Possibly, there can be process of similar PID (ex. 163589 including 63589). So check result of 'lsof -n | grep'

Related Topic