lsof Command in Linux

---

---

The lsof command in Linux is a powerful tool that stands for "List Open Files." It provides detailed information about files that are currently open by various processes. This command is invaluable for system administrators and developers alike, as it helps in troubleshooting, monitoring, and managing system resources.

Table of Contents

Here is a comprehensive guide to the options available with the lsof command −

• Understanding lsof Command
• Syntax of lsof Command
• lsof Command Options
• Examples of lsof Command in Linux
• Advanced Features of lsof Command

Understanding lsof Command

The lsof command lists information about files that are open by processes. In Unix-like operating systems, everything is considered a file, including directories, devices, and network sockets. This makes lsof a versatile tool for gathering information about system activity and diagnosing issues.

Syntax of lsof Command

The basic syntax for the lsof command is −

lsof [options] [file/directory/PID]

Without any options, the command lists all open files.

lsof Command Options

Here are some of the most commonly used options with the lsof command −

Examples of lsof Command in Linux

Let's explore some practical examples to understand how to use the lsof command effectively.

List All Open Files

This command lists all open files by all processes. The output includes columns like COMMAND, PID, USER, FD (file descriptor), TYPE, DEVICE, SIZE/OFF, NODE, and NAME −

lsof

List Files Opened by a Specific User

Replace username with the actual username to list all files opened by that user −

lsof -u username

List Files Opened by a Specific Process

Replace PID with the actual process ID to list all files opened by that process −

lsof -p PID

List Files Opened by a Specific Command

Replace command with the name of the command to list all files opened by it −

lsof -c command

List Network Connections

This command lists all files opened by network connections. You can specify IPv4 or IPv6 by using -i 4 or -i 6 −

lsof -i

List Files Opened on a Specific Port

Replace port with the actual port number to list files opened on that port −

lsof -i :port

List Files Opened by TCP Connections

This command lists all files opened by TCP connections −

lsof -i tcp

List Files Opened by UDP Connections

This command lists all files opened by UDP connections −

lsof -i udp

List Files in a Specific Directory

Replace /path/to/directory with the actual directory path to list all files opened in that directory −

lsof +D /path/to/directory

List Files Using a Specific File Descriptor

Replace FD with the actual file descriptor to list using it −

lsof -d FD

List Files with a Specific Type

This command combines multiple to list files opened by a specific user and using a specific file descriptor −

lsof -u username -a -d FD

List Files Opened by a Specific Process Name

Replace process_name with the actual process name to list files opened by it −

lsof -c process_name

List Files Opened by a Specific PID and User

This command lists files opened by a specific process ID and user −

lsof -p PID -u username

List Files Opened by a Specific Network Connection Type

Replace port with the actual port number to list files opened by TCP connections on that port −

lsof -i tcp:port

List Files Opened by a Specific Command and User

This command lists files opened by a specific command and user −

lsof -c command -u username

Advanced Features of lsof Command

In addition to the basic options and examples, lsof provides advanced features that can be useful in specific scenarios. Let's explore some of these features with practical examples.

Combining Multiple Criteria

This command combines multiple to list files opened by a specific user and a specific process ID −

lsof -u username -a -p PID

Disabling Hostname Resolution

This command disables hostname resolution, which can speed up the output when listing network connections −

lsof -n

Repeating the Listing

This command repeats the listing every 5 seconds, providing a real-time view of open files −

lsof -r 5

Outputting Only Process IDs

This command outputs only the process IDs of the processes that have open files −

lsof -t

Listing Files Opened by a Specific User and Command

This command lists files opened by a specific user and a specific command −

lsof -u username -c command

Listing Files Opened by a Specific User and Network Connection

This command files opened by a specific user and TCP connections −

lsof -u username -i tcp

Listing Files Opened by a Specific Process and Network Connection

This command lists files opened by a specific process ID and UDP connections −

lsof -p PID -i udp

Listing Files Opened by a Specific Command and Network Connection

This command lists files opened by a specific command and TCP connections −

lsof -c command -i tcp

Listing Files Opened by a Specific User, Command, and Network Connection

This command lists files opened by a Specific User, Command, and Network Connection −

lsof -u username -c command -i udp

Conclusion

The lsof command is an essential tool for anyone working with Linux systems. It provides a wealth of information about open files and the processes accessing them, making it invaluable for troubleshooting and system management.

By mastering the various options and examples provided in this tutorial, you'll be well-equipped to leverage the full power of the lsof command in your daily tasks.