lsof Command in Linux

Introduction

The lsof command in Linux is a versatile tool that displays a list of all open files and the processes using them. Because everything in Linux is treated as a file—whether it’s a regular file, a directory, a socket, or even a network connection—lsof is highly useful for system administrators to manage resources, troubleshoot issues, and monitor system activity. Here’s a comprehensive look at how lsof works and how to use it.

What is lsof?

The lsof command lists open files on a Linux system. An “open file” in this context could be anything that an application is currently accessing. For instance, if a process is reading from a file, or if a network socket is open, lsof can display details about those operations. Since it’s a root-level utility, using lsof often requires elevated permissions (i.e., running it with sudo).

Basic Syntax

The basic syntax of the lsof command is:

lsof [options]

Guidelines

Please use sudo in front of all the examples shown below to see the results for all the files

General use case of lsof command in linux

1. List All Open Files with the lsof command

To display all open files, simply use lsof without any options:

lsof

This outputs a list of open files, their respective processes, file descriptors, and other details. However, due to the sheer volume of output on a busy system, it’s often helpful to filter the results using additional options.

2. Listing Open Files by User

To find files opened by a specific user, use the -u option followed by the username:

lsof -u username

For instance, if you want to view open files by the user john, you would use:

lsof -u ubuntu

This command is especially useful for system administrators monitoring resource usage by specific users.

3. Find Processes Using a Specific File with the lsof command

To determine which processes are using a particular file, specify the file’s path as an argument:

lsof /path/to/file

This can help with troubleshooting issues, such as when you can’t modify or delete a file because it’s in use by another process.

4. List Network Connections

lsof can also show open network connections. By using the -i option, you can see all processes communicating over a network:

lsof -i

To list only TCP connections, use:

lsof -iTCP

For UDP connections, use:

lsof -iUDP

You can further specify the port to target a specific service. For example, to see processes using port 80 (HTTP), use:

lsof -i :80

5. Checking Specific Protocols

To list processes using a particular protocol (e.g., IPv4 or IPv6), use the -i4 or -i6 options:

lsof -i4 # Lists only IPv4 connections lsof -i6 # Lists only IPv6 connections

This is useful for determining network traffic and troubleshooting connectivity issues.

6. Identify Processes Using a Directory

To list all files opened within a specific directory, use the +D option followed by the directory path. For example:

lsof +D /var/log

This command can be helpful if you want to monitor which processes are accessing files within a specific directory.

7. Killing Processes with lsof command

In cases where a file is locked by a process, you may want to terminate that process. Use lsof to identify the PID, and then use the kill command. For example, to release a locked file:

lsof /path/to/locked/file

After identifying the PID, you can end the process:

kill -9 <PID>

Warning: Using kill -9 forcefully terminates the process and may result in data loss if it’s writing to a file.

8. Monitor Files Opened by a Specific Command

You can filter open files by a specific command or process name using the -c option in lsof command:

lsof -c apache2

This example will display files opened by apache2, which can be helpful when troubleshooting web server issues.

9. List Files Opened by a Specific PID

To see files opened by a particular process ID, use the -p option:

lsof -p <PID>

For example, to list all files opened by a process with PID 1234:

lsof -p 1234

This is beneficial for isolating the activity of a single process.

10. Using lsof with Grep

Since lsof output can be quite large, you can combine it with grep to narrow down the search. For instance, to list all files containing the word “nginx” in their names:

sudo lsof | grep nginx

11. Filtering by File Descriptor

Each open file is associated with a file descriptor (FD), which is a unique identifier. The FD values indicate the type of file access:

• cwd: Current Working Directory
• txt: Text file (program code)
• mem: Memory-mapped file
• rtd: Root directory
• u: File opened with read/write permissions

To filter by FD, use:

lsof -d FD

For instance, to list files with FD cwd:

lsof -d cwd

12. Limit Output with lsof Options

Sometimes you may want to limit lsof output to certain fields for clarity. You can use -F to specify only the fields you want to display. For instance, to list only PIDs and file names:

lsof -Fp -Fn

This compact view can be useful when scripting.

Example Use Cases

1. Identify Who’s Using a Locked File:bashCopy codelsof /path/to/locked/file This helps determine if a file is in use and by which user.
2. Monitor Network Activity:bashCopy codelsof -i -n -P This lists all open network connections without DNS resolution, making the command faster and more suitable for real-time monitoring.
3. Check Open Ports for Security Audits:bashCopy codelsof -i :22 List processes using port 22 (typically SSH), which can be helpful for security checks.

Quick Reference

• List all open files: lsof
• List by user: lsof -u username
• Find specific file users: lsof /path/to/file
• Check network connections: lsof -i
• Delete locked files: Use kill with PID found in lsof

Conclusion

The lsof command is a powerful Linux utility that’s essential for monitoring and managing open files, whether they’re regular files, directories, or network sockets. By providing insight into which processes are using resources, lsof aids in troubleshooting, optimizing system performance, and maintaining security.

Editorial Team