lsof Command: List Open Files
Summary
The lsof command lists information about files opened by processes. It's invaluable for troubleshooting issues like identifying which process is locking a file or using a specific network port.
Introduction
lsof (List Open Files) is a powerful command-line utility in Linux-like operating systems. It allows you to identify which processes have opened specific files. In Linux, "everything is a file," encompassing regular files, directories, network sockets, pipes, devices, and more. lsof can identify the processes using any of these file types. It's a diagnostic and administrative tool that can reveal a lot about the system's operation and help debug resource conflicts.
Use Case and Examples
List all open files
This command lists all open files and the processes that opened them. The output will be quite extensive, especially on a busy system.List open files by a specific user
This command lists all open files for the user "nap". Replace "nap" with the actual username.List open files for a specific process ID (PID)
This command lists all open files for the process with PID 1234. Replace "1234" with the actual PID. You can obtain the PID using commands likeps aux. List open files for a specific file
This command lists all processes that have the specified file open. Replace/path/to/file with the actual path to the file. List processes listening on a specific port (e.g., port 80)
This command lists all processes listening on port 80. Useful for identifying which application is using a specific network port.List all network connections
This command lists all open network connections, including TCP and UDP sockets, and displays the associated process IDs.Find which process is using a specific UDP port (e.g., port 53)
This command lists the process using UDP port 53 (typically DNS). This is helpful for identifying the name server process.Commonly used flags
| Flag | Description | Example |
|---|---|---|
-u | Lists files opened by a specific user. | lsof -u nap (Lists files opened by user 'nap') |
-p | Lists files opened by a specific process ID. | lsof -p 1234 (Lists files opened by process with PID 1234) |
-i | Lists open network files (sockets). Can be used with a port number to find the process using that port. | lsof -i :80 (Lists processes using port 80) |
-c | Lists files opened by processes with names starting with a specific string. | lsof -c apache (Lists files opened by processes named apache, apache2, etc.) |
-d | Lists files opened using a specific file descriptor. | lsof -d 3 (Lists files opened using file descriptor 3) |
+D | Lists files located in a specific directory and its subdirectories. Must be followed by the path to the directory and a recursion depth number. | lsof +D /var/log 2 (Lists all open files recursively down two levels in the /var/log directory.) |
+f | Inhibit conversion of network numbers to host names for faster output. | lsof +f |
-t | Only output process IDs (PIDs). Useful for piping to other commands. | kill $(lsof -t -i :80) (Kills the process using port 80) |
-w | Suppresses warnings. | lsof -w |