Every execution of lsof issues a warning about the TraceFS:

$ lsof any-file
lsof: WARNING: can't stat() tracefs file system /sys/kernel/debug/tracing
      Output information may be incomplete.

$ mount | grep trace
tracefs on /sys/kernel/debug/tracing type tracefs (rw,relatime)

(This is on Ubuntu 15.10, fully updated)

Is it normal for TraceFS to be mounted during normal operation?
If so, how can I tell lsof to skip it?


The answer to your question is in the file permissions:


$ ls -l /sys/kernel/debug/tracing
ls: cannot access '/sys/kernel/debug/tracing': Permission denied
$ ls -l /sys/kernel
total 0
drwx------  31 root root    0 2016-06-15 11:06:47 debug

So, normal users are not allowed to access /sys/kernel/debug/tracing and there seems to be no way to ask lsof to avoid accessing it.

We could then discuss whether this is a bug or not, but the answer to your question boils down to this.

  • What do you mean "bug"? "lsof" needs to be executed with "sudo" or as "root".
    – Rinzwind
    Jun 15 '16 at 10:00
  • 1
    lsof doesn't need to be run as root. We can discuss about its security (see man lsof) but it definitely doesn't need to be run only with superuser grants. It sits in /usr/bin not in /usr/sbin.
    – EnzoR
    Jun 15 '16 at 10:12
  • "No way to avoid it" is a perfectly acceptable answer. Besides, it appears that TraceFS no longer gets mounted by default as of Ubuntu 16.04; the warning when running lsof as a normal user has now disappeared.
    – Zilk
    Jun 16 '16 at 20:20
  • 3
    I'm on 16.04, it hasn't disappeared - still an issue. Oct 27 '16 at 15:41
  • @TenLeftFingers It's working in my up-to-date Kubuntu 16.04!
    – EnzoR
    Oct 27 '16 at 16:24

I had the same problem and this answer helped me to understand the problem a little better.

I've found out that one way to remove the annoying warning is to umount debugfs

mount | grep debugfs 
none on /sys/kernel/debug type debugfs (rw,_netdev)

sudo umount $(mount | grep debugfs | awk '{print $3}')

If you now run lsof there is no warning.

  • 2
    this is really why I came looking. I don't care so much why the error is showing up. I really just want it to go away. Thanks damko!
    – cjac
    Jan 22 '18 at 21:32
  • umount: /sys/kernel/debug: target is busy.
    – msangel
    Aug 4 '19 at 0:34

The issue is that you do not have permission to access the debugfs directory. The tracefs directory was created to allow people to mount the tracing directory directly at /sys/kernel/tracing and not require enabling debugfs. But for backward compatibility, when mounting the debugfs directory, it would automatically mount tracefs in the "tracing" directory of debugfs.

Now when you perform lsof it looks at the /proc/filesystems file as well as /proc/mounts. It sees that tracefs is mounted at /sys/kernel/debug/tracing, and thus tries to stat it. Unfortunately, because /sys/kernel/debug wont let non-root users see inside of it, you get the error message when trying to stat the directory "tracing" from within /sys/kernel/debug. If you unmount the debugfs directory, the warning will go away.


The Warning is written to stderr. You can always just redirect this to the /dev/null:

lsof <any-file> 2>/dev/null


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.