Linux

lsof Command in Linux with Examples

Narendra
April 11, 2024
- 2 mins read

Try this guide with our instant dedicated server for as low as 40 Euros

Not many users are aware of the number of files open at any time on a Linux system. Given the small size of many of these files, the users don’t see a significant increase in resource consumption.

The challenge in Linux and other Unix-like environments is that everything from actual files to devices is viewed as a file. In most cases, related files are grouped together in folders. As a result, the system uses a significant number of files to handle system operations.

Given this importance, it is no wonder that Linux offers lsof (List Open Files) as a powerful utility to gain insights into the files open on their system at any given time.

In this tutorial, we will start by providing an overview of the lsof command in Linux. Next, we will discuss how to use the command in several practical scenarios.

Table Of Contents

An Overview of the lsof Command in Linux
lsof Command Options
Examples of Using lsof Command in Linux
Conclusion
FAQs

An Overview of the lsof Command in Linux

The standard command syntax for lsof is as follows:

# lsof [options]

We strongly recommend that you run lsof with sudo (or better) privileges to prevent Permission Denied errors.

lsof Command Options

The real power of the lsof command lies in the options that modify the default behavior and allow you to use the command in a wide range of scenarios. The following table presents the frequently used options for the command.

Examples of Using lsof Command in Linux

Let’s use the lsof command to solve real-world challenges related to file management.

The Prerequisites

Before going into the details of these examples, make sure you have the following:

A system running a mainstream Linux distribution.
A user account with root or sudo rights.

Example #1: List All Files

When used without any options or parameters, lsof displays a list of all files that any process has opened:

# sudo lsof

Note that the command will produce several screenfuls of output. A more common way of using this command is to pipe the output to a pager such as less. The command syntax, in this case, will be as follows:

# sudo lsof | less

Press the Enter key or the Down arrow to scroll to the bottom of the list. Finally, use Q to exit the list.

The header of the lsof output has several columns that present various information about the output. Note that not all files use every column.

The lsof output’s default columns are:

COMMAND: Refers to the command connected to the application that opened the file.
PID: The file’s working process’s process identification number.
TID: Indicates a task id for the related process. If the file has been opened by a process rather than a task, this column will be blank.
TASKCMD: Refers to the command name in the first column. When a task modifies its command name, TASKCMD and COMMAND may not always match.
USER: Identify the user account connected to the file. The column can contain the user ID or name.
FD: This is the name of the file descriptor that the process links to the file.
TYPE: Displays the file’s identifying number and kind.
DEVICE: Show the related device numbers for the file.
SIZE/OFF: Represents the value (size or offset) or file taken during runtime.
NODE: The directory’s or parent directory’s node or inode number for the local file.
NAME: Displays the file’s path or link.

Example #2: Filters the Files Occupied by the Kernel

The output of the lsof command in Linux typically includes files that are opened by the kernel. You can exclude these files with the -b flag in the following syntax:

# sudo lsof -b

Example #3: Show Files on a Particular Filesystem

To view the open files in a certain file system, use the following command syntax:

# sudo lsof / [file system] /

For example, run the following to view all open files in the sys directory:

# sudo lsof / usr/

Example #4: List All Terminal Files

Use lsof to list all open files connected to the terminal by pointing it at the dev directory:

# lsof /dev/tty*

Example #5: Display Every File Connected to a User

We recommend using the -u flag to see the files that a particular user has opened. The command syntax is as follows:

# sudo lsof -u [username]

For instance, run the following command to view all files by the user ubuntu22:

# lsof -u ubuntu22

Alternatively, you can run the following command syntax to filter out the files associated with a specific user account:

# sudo lsof -u ^[username]

Continuing our previous example, consider the following command that excludes the files associated with the user ubuntu22 from the output:

# lsof -u ^ubuntu22

Example #6: Show Files Held by a Process

Use the -c flag to list the files opened by a process. In this case, the command syntax will be as follows:

# sudo lsof -c [process]

For instance, the following command lists all files opened by the wpa_suppl process:

# sudo lsof -c wpa_suppl

You can get similar results by providing a partial application name. Note that the output of the following command may be more extensive than the previous command:

# sudo lsof -c wpa

Alternatively, you can pipe the output of the lsof -c command into grep to filter results for a specific application:

# sudo lsof | grep wpa_suppl

Example #7: List Files Opened for a Particular PID

To list files associated with a specific process ID (PID), use the -p option. For instance, the following command displays every file with PID 850023.

# sudo lsof -p 850023

Alternatively, you can exclude the files opened by a specific process by adding the caret (^) symbol:

# sudo lsof -p ^850023

In addition, you can add the Parent Process Identification Number (PPID) to the output with the -R flag. The command syntax, in this case, will be:

# sudo lsof -p [PID] -R

For instance, run the following command to get the PPID for the 850023 PID.

# sudo lsof -p 850023 -R

Example #8: Display Files Inside a Directory

Use the following command to view all files that have been opened under a specific directory:

# sudo lsof +D [directory path]

The subdirectories are repeatedly searched with this option. Since this could take a lot of time, we recommend using the +d flag to prevent this recursion.

Example #9: List All Current Files Accessed Via Network Connections

Use the lsof command in Linux with the -i parameter to see which files are opened via a network connection. The syntax of the command is as follows:

# sudo lsof -i

In the context of listing files opened via network connections, lsof is a very flexible utility that can list these files in several ways.

For instance, run the following command to filter files according to IP address versions:

# sudo lsof -i [IP version number]

Use this command to see just the files opened by the IPv4 connections:

# sudo lsof -i 4

You can also list files mapped to a protocol. Here, you have two options – TCP or UDP:

# sudo lsof -i [udp or tcp]

Finally, you can identify the processes that use a given port. To find out which file is stopping another app from binding to a certain port, use the port number or service name from the name column to run the command:

# sudo lsof -i :[port number/name]

Example #10: List PIDs Associated with Open Files

Use the -t flag and supply the file name to view PIDs for processes that have viewed a specific file. The command syntax in this scenario is as follows:

# lsof -t [file name]

Example #11: Terminate Every User’s Process

In addition to the previous example, the -t switch ends all processes a particular user runs. Note that you need to be logged in as a root user for this command. For instance, use the following command to end all processes run by the user ubuntu22:

# kill -9 'lsof -t -u ubuntu22'

Example #12: Print Every File Using Memory Mapping

Run the following command to list the processes that have memory-mapped files:

# lsof -d mem

Example #13: Show Deleted and Locked Files

A process may lock big files even after removing them, which means these files continue to occupy disk space.

To locate deleted files in Linux that are still locked by a process or processes, we recommend piping the output to the grep utility. In the following example, we have used a slash (/) as the path symbol to locate deleted files from the root directory:

# sudo lsof [path] | grep deleted

Example #14: Merge Multiple lsof Options

You can combine multiple search flags with the lsof command. We will now discuss some common cases.

List the files that a specific user or process has open with the following command:

# sudo lsof -u [username] -c [process]

You can also list files that match both the first and second search terms. For this, you can combine the terms with the logical and operator -a:

# sudo lsof -u [username] -c [process] -a

You can run the following command to identify every network connection initiated by a user:

# sudo lsof -i -u [username] -a

Conclusion

To list open files and processes in Linux, use the “lsof” command. It provides information on sockets, files, directories, and other things. Using “lsof,” users can monitor network file connections, filter results by user, and discover processes related to open files. It also helps locate programs that obstruct file operations and keep an eye on access to particular files. “lsof” is a useful tool for system administration and troubleshooting since it shows open ports and the processes connected to them. Its adaptability makes it a go-to tool for managing file and process activity on Linux systems, improving system performance and security.

Experience unparalleled dedicated hosting with Redswitches, the leading provider globally. Elevate your online presence with reliable servers, unmatched performance, and dedicated support. Choose Redswitches for a seamless hosting experience that exceeds expectations.

If you’re looking for a robust server for your Linux projects, we offer the best dedicated server pricing and deliver instant dedicated servers, usually on the same day the order gets approved. Whether you need a dedicated server, a traffic-friendly 10Gbps dedicated server, or a powerful bare metal server, we are your trusted hosting partner.

Start using RedSwitches right now to fully realize the potential of your website.!

FAQs

Q. What is the lsof command used for in Linux?

The lsof command lists open files and processes on a Linux system.

Q. How can I install lsof on my Linux system?

Linux releases typically have lsof pre-installed. If not, you can install it with your package manager. For instance, you can perform sudo apt install lsof on computers running Debian or Ubuntu.

Q. Can lsof display network-related information?

Lsof can show details about open network connections, such as established connections and listening ports.

Q. How can I filter lsof results to show only certain users’ processes?

You can use the -u option and the username to filter lsof results. For instance, running lsof -u username will only show the processes connected to the given user.

Q. Is it possible to use lsof to identify processes blocking file operations?

Yes, lsof can help identify processes preventing files from being unmounted or deleted, allowing you to troubleshoot and resolve the issue.

Q. Can I monitor specific files with lsof?

You can use lsof to monitor specific files and track which processes are accessing them by specifying the file path as an argument.

Q. How do I view open ports and their associated processes using lsof?

You may use lsof to see open ports and the listening processes by using the —i option. Using lsof, for instance, I can display all open network connections and ports.

Q. Is lsof available on other operating systems besides Linux?

Yes, lsof is also available on other Unix-like operating systems with similar functionality, such as macOS and BSD variants.