lsof is the list-open-files CLI. It prints which process holds which file, socket, or deleted inode. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
Accidental sysadmins land on lsof because lsof -i or lsof +L1 shows who still holds a port or a deleted log. Then disk is at 91%, nginx dies, and last night's COMMAND/PID/FD lines do not say what to run. A filling /var is a Tink warning; it is not a NAME column.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using lsof if you already want an open-file table on an SSH session. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | lsof |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Install lsof, then sudo lsof -i / -p every time a FD or port looks wrong |
| What you get | Working monitoring, diagnosis, and approved fixes | A live open-file table: COMMAND, PID, FD, TYPE, NAME — only while you are looking |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who SSHs in after the outage |
| Hidden costs | None — fully managed | Root for most files, deleted-but-open inodes, and whether anyone was watching when the FD leaked |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Process FD dump. lsof does not parse auth.log or propose a command |
| Configuration | None after install — heuristics and AI | Filters, network vs file vs deleted, and whether you remembered -n so DNS does not stall the listing |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read COMMAND, FD, and NAME yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Monitoring only — lsof cannot restart nginx, truncate a leaked log, or rotate a cert |
| Alerting | Built-in across 8 channels | None by default — lsof is a snapshot; paging is extra |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live FDs only — lsof does not forecast fill time or a quiet NIC going bad later |
| SSH brute-force detection | Built-in — parses auth.log every scan | Not included — lsof does not read host auth.log or journald |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down you cannot SSH into lsof either |
| Public status page | Shareable URL with 90-day history | Not included — lsof has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — an FD table is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + lsof. No mechanic you text when /var filled |
| Learning curve | None — works after install | Low to launch; higher to map a deleted inode to the process that filled the disk |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators who already want an open-file table and will still SSH in when the box is sick |
Keep using lsof when you already want that exact job:
The binary is cheap to install. A working ops loop for five Linux boxes is not:
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens lsof after the outage, and every scan includes a diagnosis a quiet FD table will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs ss · Tink vs tcpdump · Tink vs Wireshark