Dear Maintainer,

   * What led up to the situation?

I updated openssl and wanted to check for proccess still using the old version.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

I ran lsof and parsed the output.

   * What was the outcome of this action?

The value DEL appeared in the FD column for proccesses using the old libssl.

lsof | head -n1; lsof -p 7634 | grep DEL
COMMAND     PID   TID       USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
nginx       7634            root   DEL     REG                0,4            16460 /dev/zero
nginx       7634            root   DEL     REG                9,1           515514 /usr/lib/i386-linux-gnu/i686/cmov/libcrypto.so.1.0.0
nginx       7634            root   DEL     REG                9,1           515515 /usr/lib/i386-linux-gnu/i686/cmov/libssl.so.1.0.0
nginx       7634            root   DEL     REG                0,4            16463 /dev/zero

   * What outcome did you expect instead?

I expected DEL to appear in the TYPE column for processes using the old libssl, as described by the lsof man page.

NOFD is also supposed to appear in the 'TYPE' column according to the
docs, but actually appears in the 'FD' column.

Richard

Hello,

I'm contacting you about lsof.

When reading the manpage (and the FAQ), it mentions that on linux, when
a file has been deleted the *TYPE* column shows "DEL". But it seems that
it's currently the FD column that shows this (same for NOFD).

Is this an error in the documentation? Or is this a real bug?

This has been originally reported to the Debian BTS, see bug #743940 [0]

Kind regards,

Laurent Bigonville

[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743940