Use lsof to check files openned by a process

“lsof” meaning ‘LiSt Open Files’ is used to find out which files are open by which process. As we all know Linux/Unix considers everything as files (pipes, sockets, directories, devices etc). One of the reason to use lsof command is to find out if there is any file system problem.

For example, we see some processes like the following in CloudLinux Environment.

lscgid -n 161

and lscgid is constantly running 100%CPU

1193334 root 20 0 15180 980 788 R 100.0 0.0 0:53.02 lscgid

 lsof -p pid

Looks like cagefs mount points messed up. It tries to an endless file under /proc,

# more /proc/1204041/mounts

1204041 is live 100% cpu lscgid process.

it has endless

/dev/mapper/centos_linux2-root /var/cagefs/78/tahacocukoyunpar/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0
/dev/mapper/centos_linux2-root /usr/share/cagefs-skeleton/var/cpanel/userdata/tahacocukoyunpar xfs rw,nosuid,relatime,attr2,inode64,usrquota 0 0

try `cagefsctl --force-update` and lscgid process can finish now but CPU usage is still high. The user will need to contact CloudLinux support for the cagefs mount problem.

**'lscgid -n xxx'** is for LitesSeed to start a Suexec PHP processes and use lscgid to gain root then change user id. Usually, it will immediately execute PHP binary, so won't see it running normally.