Every object in a Linux computer is considered as a file. These files are organized inside the directories. When your computer runs, it has multiple files and directories open, which are used by different processes. You can list these open files and directories using the lsof command.
In this tutorial, we will learn how to use the lsof command in Linux to list open files using examples.
Prerequisites
- A Linux computer with terminal access.
- Some familiarity with Linux/UNIX commands.
- Root user or sudo privileges to list root-owned files.
- Willingness to learn new commands
Lsof Command
The lsof command stands for list open files, is used to list all open files and directories. This command helps you find out which files are opened by various processes, the user’s process list, and the list of processes listening on a particular port. You can also use this command to debug disk unmounting errors that are caused when the files are in use by other processes.
The lsof command lists not only the regular files, but also lists shared libraries, block special files, regular pipes, named pipes, character special files, UNIX domain, Internet sockets, file system mount points, and disk files. Use the lsof command with its options or the grep command to filter out the results.
lsof command requires root or sudo access as most processes or devices it lists belonged to root.
By default, the lsof command is automatically installed with all major Linux distributions. However, if it is not available in your distribution, then you need to first install the command to try these examples.
Syntax
This is the basic syntax of the lsof command:
lsof [option] [username]
How to Use Linux Lsof Command
The lsof command can be used in different ways, with or without additional options. When used without options, it lists hundreds of files that are currently open. The options help you narrow down the search results. For example, pass the directory as an option to list all the files that are opened from a directory and the processes that opened those files.
If you run the lsof command as a regular user, not the root user, then you will see several “permission denied” errors because many system files and processes are restricted only to the root user.
Lsof Options
The lsof command provides a number of options to filter out the file lists. The following table describes some of the most commonly used lsof options:
Option | Description |
^ | Negated option to list all the files that are open by users, PIDs, and UIDs except for the specified users, PIDs, and UIDs. |
-u | Lists files opened by the specified user. |
-c | Lists files opened by the specified process. |
-p | Lists files opened by the specified process ID. |
+D | Lists files opened by the particular directory. |
-i | Lists files opened by the network connections, protocols, and ports. |
Linux Lsof Command Examples
The lsof command provides various options to narrow down the search results when listing the open files. The following Linux lsof command examples will show you some of the most common use cases of this command.
List All Open Files
Use the lsof command without any options to list all the open files on your Linux computer:
lsof
The lsof output is usually very long and you can use lsof | more to display one screen output at a time to make it more readable.
List Files Opened by a Specific User
Several users can access a Linux computer at a given time. Every user has different file and device requirements. To list the files that are opened by a particular user, type:
lsof -u tom
You can also use lsof to display output for multiple users in a single command, such as:
lsof -u username1, username2
Or, you can list all the files that are opened by all the users except for the specified user. For example, to display all the files that are not opened by the root user, type:
lsof -u^root
List Files Opened By a Process
A Linux process may use several files at a time to complete its operations. The following command helps you list open files used by a particular process:
lsof -c network
You can also use the PID or process identification number, instead of the process name to list files opened by a particular process ID:
lsof -p 11
To list open files for multiple process IDs in a single command, type:
lsof -p PID1, PID2, PID3
Filter Open Files by Filename
Use the filename as an argument to list all the processes that have opened the specified file:
lsof /var/log
List all Files Opened by a Directory
To list all the files that are opened by a particular directory, supply the directory name as an argument of lsof:
sudo lsof +D /var/log
List Files Opened by a Network Protocol
Linux supports multiple network connections to connect to different applications and devices. We can use the -i
option to list all the files used by a particular network protocol.
For example, use the following command to list the UDP protocol files:
lsof -i UDP
Similarly, we can use lsof -i TCP
to list all TCP protocol files.
List Files Used by Processes Running on Specific Port
Some Linux applications and processes require a specific port to establish a connection. To list all the open files that are used by the processes running on port 631, type:
sudo lsof -i :631
We can also list multiple port numbers, such as lsof –i :22,443
Or, specify a TCP port range along with the network protocol, such as lsof -i TCP:1-44653
.
List Files Opened by IPv4 and IPv6
The following examples show you the open IPv4 network connections files:
sudo lsof -i 4
To list open IPv6 files, type:
sudo lsof -i 6
Linux Lsof Command Headers
The output of the lsof command is organized in a tabular form to help you better understand the files and processes that are using them. The following table lists and describes the lsof command headers:
Header | Description |
---|---|
COMMAND | Command that opened the file or directory. |
PID | Process identifier of the process. |
TID | Thread or task identifier to identify the threads. |
TASKCMD | Name of the task command. This field is displayed only if the specified entry is a task. |
USER | Name of the user account that owns the file and the process. |
FD | File descriptor text string or number to indicate the file descriptor type. The most common file descriptor types are cwd (current working directory), rtd (root directory, mem (memory-mapped file), txt (program text), and mmap (memory-mapped device). |
TYPE | Type of the files, which include DIR (directory), REG (regular file), CHR (character special file), Netlink (network connections file), and FIFO (first in first out). |
DEVICE | Device identification number. |
SIZE/OFF | File size and offset represented in bytes. |
NODE | Node number of the file. |
NAME | Mount point and file system name of the file. |
Conclusion
In this tutorial, we learned how to list all open files on a Linux computer using lsof. This command comes with multiple options that you can use to sort out the files based on your requirements. The lsof command does not impact the files, so it is completely safe to use this command.
For more information browse lsof manual page or type lsof --help
on the terminal.
Comments