
Sloth – Mac app that shows all open files and sockets in use - eddyg
https://github.com/sveinbjornt/Sloth
======
newscracker
Fifteen years of maintenance and updates (by one developer) for a free and
open source tool, and just asking for donations if the user finds it useful!
I'm impressed! If I were a user, I would certainly donate.

~~~
retSava
I like to think that when I see such really nice behaviour, I should supply
positive reinforcement since I know how much such things can matter to people.
Eg I had a really nice commuter bus ride, when about to go off, I went to the
driver and said thanks, I enjoyed the ride, it was very smooth etc. I could
tell this person took pride and enjoyment in doing it. I also called his
employer and gave praise (using the bus number), hopefully this is reflected
professionally for him too.

So you don't have to be a user to show appreciation ;)

~~~
asudosandwich
After our meal of takeout BBQ last week I called the joint, which was brand
new, and thanked them for how good everything was. As a shy telephone-allergic
introvert I’d never done that before, but I’m glad I did!

~~~
retSava
Agree, it feels good doing it. :)

------
frou_dh
The stock _Activity Monitor_ app provides a sparse-looking version of this
(double-click a process, then select 'Open Files and Ports')

~~~
plorkyeran
Activity Monitor makes it reasonably easy to check which files a process has
open, but does not reasonably handle the inverse case of checking which
processes have a specific file open.

------
lsiebert
This can be installed using homebrew with:

brew cask install sloth

~~~
tjbiddle
I know Homebrew is vetted, but I personally like to always check where this is
pulling in its installer file - and it appears to match the domain as is in
the Github repo.

[https://github.com/Homebrew/homebrew-
cask/blob/master/Casks/...](https://github.com/Homebrew/homebrew-
cask/blob/master/Casks/sloth.rb)

~~~
heyoni
You might already know this but you can do that by command line with 'brew
cask audit sloth' to see where it's pulling from...I'm paranoid enough too :O

~~~
cimi_
Audit seems to be checking the formula code not the source of the download?

[https://docs.brew.sh/Manpage](https://docs.brew.sh/Manpage)

> Check formula for Homebrew coding style violations. This should be run
> before submitting a new formula. Will exit with a non-zero status if any
> errors are found, which can be useful for implementing pre-commit hooks. If
> no formula are provided, all of them are checked.

[https://github.com/Homebrew/homebrew-
cask/blob/master/USAGE....](https://github.com/Homebrew/homebrew-
cask/blob/master/USAGE.md)

> audit — verifies installability of Casks

You can see where it pulls from if you provide the --download flag but as far
as I can understand it does not do any other validation regarding that.

    
    
      brew cask audit virtualbox --download
    

AFAIK checksums are checked even if you don't run audit.

~~~
heyoni
I made a mistake! The command is ‘brew cask cat’ to see where it’s coming
from.

------
sjmulder
This looks like such a nice app! Proper Mac UI too. I'm going to try it out as
soon as I get home.

~~~
Waterluvian
This is interesting to me because it's an example of the other side of the
"Electron" argument.

`lsof` exists in Linux. At least, my Ubuntu 16.04 has it. So if this were an
Electron UI, would we instantly have a Linux version as well? Or is it not
that simple?

I _do_ really enjoy the look and feel of this mac version, though.

~~~
lawnchair_larry
Taking something as lightweight as an lsof command line tool and putting an
entire web browser and node.js instance on top seems like we are moving in the
wrong direction. It’s like we are going to need a terabyte of RAM and a Tesla
battery to run basic apps of the future with even half of the performance we
got out of our systems 2 decades previously.

~~~
joppy
I'm not sure that I would call something with about 40 screens of man pages
"lightweight".

~~~
yakshaving_jgt
The size of the program’s man page doesn’t impact the performance
characteristics of the program, does it?

~~~
joppy
No, but "lightweight" doesn't necessarily mean performant. The size of the
program's man page might be the thing that makes people want a different, more
discoverable interface to the program.

------
Congeec
Any reason you choose to build on the command line interface of lsof rather
than reusing its api by diving into its source code?

~~~
randomsearch
Command line interfaces usually more stable, documented and easy to use.

~~~
Tepix
Stable? You must be joking?

~~~
simias
For standard Unix tools? Not really, since they're often used in scripts and
everything breaks if the formatting changes. Generally any new feature is
hidden behind new flags on the command line to avoid breaking anything. There
are exceptions of course but I doubt the output of lsof will change any time
soon.

Meanwhile kernel ABIs can and do change between versions (the API less so, but
it still means that you have to rebuild your code).

What can happen however is that a tool of the same name might have a different
output or behavior on different operating systems (most notably between the
GNU and BSD variants). But in this case the kernel API is probably different
as well, so you'll have to implement an abstraction layer anyway.

~~~
akerl_
In this case, `lsof` is a relatively lightweight parser for /proc. The /proc
filesystem API is amazingly stable. The unstable ABI is internal to the kernel
itself; the interaction with userspace is where backwards compat is held as
the highest guiding principle (see Linus's remarks about breaking userspace).

By contrast, lsof can change output at any time. I've not done enough parsing
of lsof to be familar with past changes, but have seen meaningful changes in
the default output of lsblk, df, and other core CLI tools that wrap system
information.

~~~
rabidcondor
macOS, with its BSD roots, doesn't have a proc filesystem.

~~~
comex
If anyone's curious: Traditionally, lsof on BSD would just open /dev/kmem and
read the info directly out of the kernel's data structures! It still does that
on FreeBSD, and used to do it on macOS prior to 2006, when Apple added the
more sensible (and stable) libproc.h API in one of the Tiger software updates.

Sloth dates back to 2004, at which point parsing lsof's output would
definitely have been a more sensible choice than replicating the kmem parsing
code. On the other hand, if I were writing something like Sloth today, though,
I'd use libproc, because I think it'd be easier overall, and it would also
make it more feasible to improve the core functionality (like adding a
progress bar or lazy querying).

However, lsof does have a flag (-F) to specify how to format its output,
explicitly documented in the man page as being intended for other programs
that want to parse its output, implying that it will remain stable. And Sloth
uses this flag. Thus, even from a modern perspective, its approach is
perfectly reasonable.

~~~
lawnchair_larry
Huh, so that means you need root to run lsof on freebsd?

~~~
saagarjha
lsof seems to be setgid on FreeBSD (group kmem).

------
phoe-krk
Are there any alternatives for other Unices and Unixlikes?

~~~
lsiebert
lsof was written by vic abell, who also wrote a graphical java gui for it,
glsof.

[http://glsof.sourceforge.net/](http://glsof.sourceforge.net/)

~~~
TheCabin
Any thoughts about pros / cons when compared with Sloth?

~~~
josteink
Lsof is Unix-standard, part of coreutils, and can be used anywhere, piped and
automated.

Sloth exists only on OSX and is a GUI app.

I’d ask the opposite: Any reason anyone would anyone use Sloth over lsof?

~~~
saagarjha
It works very well on macOS, which is an OS that I use for a large amount of
time?

~~~
yakshaving_jgt
Does lsof not work very well on MacOS?

~~~
saagarjha
It works, but supposedly this works better.

------
Jack5500
Is there anything like that for Windows?

~~~
stronglikedan
Process Explorer for files, but I'm not sure about sockets.

~~~
sitzkrieg
Sysinternals tcpview for sockets side is easiest to use

------
runjake
If you like this app, you should also check out Task Explorer by reknown
security researcher Patrick Wardle.

[https://objective-see.com/products/taskexplorer.html](https://objective-
see.com/products/taskexplorer.html)

~~~
tomc1985
Man, what is up with that UI though? Like 20% of the top space for the program
name??

~~~
saagarjha
Wardle has his own style for these apps. I’m personally not a big fan if it,
since it looks out of place, but I guess it is a “branding” thing for him.

------
dandigangi
This is a nice little tool. The more I find myself running a full stack
application local (when not in Docker), lsof is quite useful. Will try this
out for sure!

------
torarnv
Is there any way (in general) to see what processes a pipe is connected to (on
both ends)?

------
rileymat2
Maybe it is just me, but I am getting tired of cute names for projects. lsof
is easy to remember (list open files), I like that.

~~~
pure-awesome
Sloth sounds like if you tried to pronounce lsof.

~~~
rileymat2
My comment was too negative. Looks very useful. I just have trouble
remembering names like this. I don't think this is a name/sound that clicks
for me.

~~~
agumonkey
I get the feeling too. I was just wondering about that this morning. Some
times you want a name that is clearly descriptive like lock_and_clean_journal
but when you have a new tool that does a lot and in a different way.. a cute
name is a good symbol to indicate 'completely new context'. Otherwise we'd get
meaningless glue code like

    
    
        pony | lulee --pew | eels | cyan ..

~~~
masklinn
> Otherwise we'd get meaningless glue code like

> pony | lulee --pew | eels | cyan ..

I mean we kinda do, it's just that we're used to the bits.

    
    
        ls | xargs cat | grep main >> /dev/nul 2>&1
    

is not inherently more meaningful than what you wrote above, you just have the
experience to interpret it.

Incidentally, powershell commands tend to be more "self-explanatory" in their
naming, at least in theory.

~~~
agumonkey
heh, not untrue, although most are bad shortenings.. ls:list, xargs:arguments,
cat:concatenate

MS did try to avoid explosion of idioms but at a tiny verbosity cost. I
believe that map/reduce is a bit a good middle ground

------
theqult
Fifteen years of maintenance and updates for having what on every normal
operative system is available in five minutes.

Yep, is definitely a Mac :D

~~~
Angostura
Well lsof is available on a Mac if you want a command line, as is Activity
Monitor. Shrug

------
aboutruby
I was expecting some ncurses-based interface

~~~
tambourine_man
GUI, not TUI in the title

------
gregkerzhner
Holy fat controller! This whole source code is mostly in just a single file.
[https://github.com/sveinbjornt/Sloth/blob/master/source/Slot...](https://github.com/sveinbjornt/Sloth/blob/master/source/SlothController.m)

Curious what patterns you iOS developers out there do to avoid code like this?
Personally I am a big fan of ReSwift.

~~~
svth
Author of Sloth here. The controller didn't start out quite so fat, the whole
thing was quite slim, 400-500 lines, when I first put Sloth together some 15
years ago. It grew as various additional features piled on over the years.
However, your point is well taken. I should refactor things at some point.

