Re: [tlug] Chasing the GHOST in my machine

[Attila Kinali <attila@example.com>]

On Fri, 30 Jan 2015 09:19:52 +0000
Darren Cook <darren@example.com> wrote:

> > You can use 
> > lsof +c 0 | awk '/libc-/ && /DEL/ { print $1 }' | sort -u
> > to find out which processes use an old libc and then restart those
> > individually.
> 
> Can you break down what does that command does? (I guessed it would list
> all processes that link to libc and show me their version, so I expected
> a long list, but in fact I got nothing at all... now I'm wondering if it
> was stupid to run it without understanding it better... you don't work
> for the NSA do you?)

lsof +c 0	
	# list all open files, remove limit on name length
awk '/libc-/ && /DEL/ { print $1 }' 
	# on lines that match the regular expressions /libc-/ and /DEL/
	# print the first record of that line (the process name),
	# don't do anything otherwise.
	# lsof put's a DEL on those files that are opened by some process,
	# but have been deleted
sort -u
	# sort all lines, remove dublicates

HTH

			Attila Kinali
-- 
It is upon moral qualities that a society is ultimately founded. All 
the prosperity and technological sophistication in the world is of no 
use without that foundation.
                 -- Miss Matheson, The Diamond Age, Neil Stephenson