Why lsof scan the whole filesystem

[yuanjianpeng]

I mount sdc to /mnt/sdc which is btrfs filesystem with subvolume,
When umount, it's busy, so I use the command lsof -x f +D /mnt/sdc to inspect which program using sdc.

But lsof command hang for too long, it scan the whole /mnt/sdc filesystem which has millions of files.
As my knowledge, lsof just need scan /proc/*/fd, to filter paths that belong to /mnt/sdc, why scan the filesystem ?

is there any option to do this?

[jiegec]

But lsof command hang for too long, it scan the whole /mnt/sdc filesystem which has millions of files. As my knowledge, lsof just need scan /proc/*/fd, to filter paths that belong to /mnt/sdc, why scan the filesystem ?

Can you provide a strace?

[yuanjianpeng]

mount tmpfs and create 3 directories.

$ mkdir /mnt/tmp
$ mount -t tmpfs none /mnt/tmp
$ mkdir -p /mnt/tmp/a/b/c

lsof will scan tmpfs before scan procfs

$ strace -e openat lsof -x f +D /mnt/tmp 2>&1 >/dev/null | head -n 20
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/dev/null", O_RDWR)   = 3
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/proc/mounts", O_RDONLY) = 3
openat(AT_FDCWD, "/mnt/tmp", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/mnt/tmp/a", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/mnt/tmp/a/b", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/mnt/tmp/a/b/c", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/", O_RDONLY)         = 3
openat(AT_FDCWD, "/proc/141363/fdinfo/3", O_RDONLY) = 6
openat(AT_FDCWD, "/proc/locks", O_RDONLY) = 3
openat(AT_FDCWD, "/proc", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
openat(AT_FDCWD, "/proc/1/stat", O_RDONLY) = 6
openat(AT_FDCWD, "/proc/1/maps", O_RDONLY) = 6
openat(AT_FDCWD, "/proc/1/fd", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 6
openat(AT_FDCWD, "/proc/1/fdinfo/0", O_RDONLY) = 7
openat(AT_FDCWD, "/proc/1/fdinfo/1", O_RDONLY) = 7
openat(AT_FDCWD, "/proc/1/fdinfo/2", O_RDONLY) = 7
openat(AT_FDCWD, "/proc/1/fdinfo/3", O_RDONLY) = 7

[yuanjianpeng]

seems I should use +d insted of +D

[jiegec]

seems I should use +d insted of +D

yes, scanning the disk is intended if you specify +D.

[yuanjianpeng]

@jiegec what is the use case of +D

[yuanjianpeng]

But some path not showed when use +d

[jiegec]

       +d s     causes lsof to search for all open instances of directory s and the files and directories it  contains  at  its  top
                level.   +d does NOT descend the directory tree, rooted at s.  The +D D option may be used to request a full-descent
                directory tree search, rooted at directory D.

                Processing of the +d option does not follow symbolic links within s unless the -x or -x  l option is also specified.
                Nor does it search for open files on file system mount points on subdirectories of s unless the -x or -x   f  option
                is also specified.

                Note:  the authority of the user of this option limits it to searching for files that the user has permission to ex‐
                amine with the system stat(2) function.

       +D D     causes  lsof  to  search  for all open instances of directory D and all the files and directories it contains to its
                complete depth.

                Processing of the +D option does not follow symbolic links within D unless the -x or -x  l option is also specified.
                Nor does it search for open files on file system mount points on subdirectories of D unless the -x or -x   f  option
                is also specified.

                Note:  the authority of the user of this option limits it to searching for files that the user has permission to ex‐
                amine with the system stat(2) function.

                Further note: lsof may process this option slowly and require a large amount of dynamic memory to do  it.   This  is
                because  it must descend the entire directory tree, rooted at D, calling stat(2) for each file and directory, build‐
                ing a list of all the files it finds, and searching that list for a match with every open file.  When directory D is
                large, these steps can take a long time, so use this option prudently.

top level vs recursive.

[yuanjianpeng]

So require to use +D, to find all opened files of a mountpoint.