Is it normal for thousands of files to be opened by Ubuntu programs?

Question

Having used lsof, as suggested in Too many open files - how to find the culprit , I've found that thousands of files are open due to operating-system style programs such as unity-2d-, gnome-do, and nautilus. Only one of the top 50 is an application-style program (firefox).

lsof | perl -lane '$x{"$F[0]:$F[1]"}++;
END { print "$x{$_}\t$_" for sort {$x{$a}<=>$x{$b}} keys %x}' | tail -50

lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /var/lib/lightdm/.gvfs
      Output information may be incomplete.
216 unity-2d-:26285
216 unity-2d-:31600
216 unity-2d-:2577
239 nautilus:30626
239 nautilus:3777
239 nautilus:31250
239 nautilus:30781
239 nautilus:15101
241 nautilus:26123
241 nautilus:20495
241 nautilus:9627
241 nautilus:31612
241 nautilus:26298
243 nautilus:7672
243 nautilus:603
243 nautilus:21594
243 nautilus:2590
243 nautilus:17574
243 firefox:9768
243 nautilus:12422
247 nautilus:14265
256 gnome-do:31632
256 gnome-do:20519
256 gnome-do:26318
256 gnome-do:9647
256 gnome-do:26143
257 gnome-do:12437
257 gnome-do:14284
257 gnome-do:21612
257 gnome-do:622
257 gnome-do:7686
257 gnome-do:2608
257 gnome-do:17603
270 unity-2d-:3756
270 unity-2d-:30612
272 unity-2d-:15087
277 unity-2d-:12408
277 unity-2d-:21580
278 unity-2d-:2576
278 unity-2d-:14251
278 unity-2d-:587
279 unity-2d-:9613
279 unity-2d-:30768
279 unity-2d-:20481
280 unity-2d-:26109
281 unity-2d-:26284
283 unity-2d-:31599
284 unity-2d-:31235
288 unity-2d-:7658
290 unity-2d-:17559

Is this normal, or is something wrong?

Answer 1

Yes, This is normal. An Operating system can have thousands of files open simultaneously at any moment. For example, at this moment, my system has 5858 files opened.

$ lsof | wc -l
5858

Please note that, lsof by default list all files opened by all processes. So, if a file is accessed by two different processes, there will be two distinct instance in lsof output.

Also take note, the file are not all regular files. lsof manual is saying

An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path.

But there is a subtle difference in open files and open file descriptors. See this article to read this interesting topic. The important point is

What is an open file?

An open file is a file that is being used, or is it an open file descriptor? A file descriptor is a data structure used by a program to get a handle on a file, the most well known being 0,1,2 for standard in, standard out, and standard error. The file-max kernel parameter refers to open file descriptors, and file-nr gives us the current number of open file descriptors. But lsof lists all open files, including files which are not using file descriptors - such as current working directories, memory mapped library files, and executable text files. To illustrate, let's examine the difference between the output of lsof for a given pid and the file descriptors listed for that pid in /proc.

Also take a look at these links

• How do I change the number of open files limit in Linux?
• How many open files
• Ports and File descriptors