In this blog post, we are going to show you ten useful lsof commands in Linux with examples.
The lsof command is a shortcut to List open files and shows the open files and which processes are using them. The lsof output describes several things, such as the identification number of the process that has opened the file, the process group identification number, the command the process is executing, the owner of the process, and many more.
In this tutorial, we will use the latest Ubuntu 22.04 OS, but you can choose any Linux distro you want. Let’s get started!
Prerequisites
- A server with Ubuntu 22.04 OS
- User privileges: root or non-root user with sudo privileges
Update the System
If you have a fresh installation of Ubuntu 22.04, then it is recommended the system packages be updated to the latest versions available.
sudo apt update -y && sudo apt upgrade -y
Once the system is updated, we are ready to show you the ten useful lsof commands in Linux.
1. List all open files
The basic lsof command without any arguments will list all open files:
lsof
The output is very long, and it should look like this:
COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd DIR 252,1 4096 2 / systemd 1 root rtd DIR 252,1 4096 2 / systemd 1 root txt REG 252,1 1849992 13141 /usr/lib/systemd/systemd systemd 1 root mem REG 252,1 149760 690 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.
2. Files accessed by a particular process
To list the files accessed by a particular process, execute the lsof command with the -c argument and the process name.
root@host:~# lsof -c apache COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME apache2 21922 root cwd DIR 252,1 4096 2 / apache2 21922 root rtd DIR 252,1 4096 2 /
3. Opened files by a specific user
To list the files opened by a specific user, execute the lsof command with the -u option and user name.
root@host:~# lsof -u www-data COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME apache2 43491 www-data cwd DIR 252,1 4096 2 / apache2 43491 www-data rtd DIR 252,1 4096 2 / apache2 43491 www-data txt REG 252,1 758672 6242 /usr/sbin/apache2
4. Opened files associated with a specific process ID
Execute the lsof command with -p option and process ID for all open files associated with it.
root@host:~# lsof -p 21922 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME apache2 21922 root cwd DIR 252,1 4096 2 / apache2 21922 root rtd DIR 252,1 4096 2 / apache2 21922 root txt REG 252,1 758672 6242 /usr/sbin/apache2 apache2 21922 root DEL REG 0,1 1060 /dev/zero
5. Opened files based on the connection type
To check the open files based on the connection type TCP or UDP, execute the following command:
root@host:~# lsof -i tcp COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 16879 root 3u IPv4 67331 0t0 TCP *:7022 (LISTEN) sshd 16879 root 4u IPv6 67333 0t0 TCP *:7022 (LISTEN) apache2 21922 root 4u IPv6 98560 0t0 TCP *:http (LISTEN) apache2 43491 www-data 4u IPv6 98560 0t0 TCP *:http (LISTEN) apache2 43492 www-data 4u IPv6 98560 0t0 TCP *:http (LISTEN)
6. Suppresses kernel blocks
To check the suppressed kernel blocks, execute the lsof command with the -b option.
root@host:~# lsof -b COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd DIR 252,1 4096 2 / systemd 1 root rtd DIR 252,1 4096 2 / systemd 1 root txt REG 252,1 1849992 13141 /usr/lib/systemd/systemd systemd 1 root mem REG 252,1 149760 690 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1 systemd 1 root mem REG 252,1 27072 477 /usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
7. Processes that accessed particular files
To list the IDS of processes that accessed particular files execute the lsof command with the -t option.
root@host:~# lsof -t 1 3 12 13 14 15
8. Memory-mapped files
To see the memory mapped files, execute the lsof command with -d mem option.
root@host:~# lsof -d mem COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root mem REG 252,1 149760 690 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1 dbus-daem 456 messagebus mem REG 252,1 309600 591 /usr/lib/x86_64-linux-gnu/libnss_systemd.so.2 qemu-ga 524 root mem REG 252,1 27002 8333 /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cach php-fpm8. 21595 php_fpm_user mem REG 252,1 284936 1038523 /usr/lib/php/20210902/phar.so php-fpm8. 21595 php_fpm_user mem REG 252,1 35080 1038668 /usr/lib/php/20210902/pdo_mysql.so php-fpm8. 21595 php_fpm_user mem REG 252,1 162056 1038666 /usr/lib/php/20210902/mysqli.so php-fpm8. 21595 php_fpm_user mem REG 252,1 597344 28551 /usr/lib/x86_64-linux-gnu/libonig.so.5.2.0
9. Parent process IDS
To list the parent process IDs, execute the lsof command with the -R argument.
root@host:~# lsof -R COMMAND PID TID TASKCMD PPID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 0 root cwd DIR 252,1 4096 2 / systemd 1 0 root rtd DIR 252,1 4096 2 / systemd 1 0 root txt REG 252,1 1849992 13141 /usr/lib/systemd/syst rcu_tasks 10 2 root cwd DIR 252,1 4096 2 / rcu_tasks 10 2 root rtd DIR 252,1 4096 2 /
10. The man command
If you want to learn more about the lsof you need to execute man lsof in your terminal. You should receive complete documentation about the lsof command:
root@host:~# man lsof
LSOF(8) System Manager's Manual LSOF(8)
NAME
lsof - list open files
SYNOPSIS
lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-E ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i] ] [ -k k ] [
-K k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ] [ -o [o] ] [ -p s ] [ +|-r [t[m]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -x [fl] ] [ -z [z] ]
[ -Z [Z] ] [ -- ] [names]
DESCRIPTION
Lsof revision 4.93.2 lists on its standard output file information about files opened by processes for the following UNIX dialects:
Apple Darwin 9 and Mac OS X 10.[567]
FreeBSD 8.[234], 9.0 and 1[012].0 for AMD64-based systems
Linux 2.1.72 and above for x86-based systems
Solaris 9, 10 and 11
(See the DISTRIBUTION section of this manual page for information on how to obtain the latest lsof revision.)
That’s it. You just learned to use the lsof command with 10 most used options and arguments. Of course, if you have any difficulties with this, you can contact our technical support, and they will help you. You just need to sign up for one of our NVMe VPS plans and submit a support ticket. We are available 24/7.
If you liked this post about ten useful lsof commands in Linux with examples, please share it with your friends on social networks or simply leave a reply below.
Interesting, but would of benefitted by examples of how to USE lsof.
lsof is a tool to see open files. You can execute “man lsof” in your terminal to see all documentation