Lsof Command in Linux

Every object in a Linux computer is considered as a file. These files are organized inside the directories. When your computer runs, it has multiple files and directories open, which are used by different processes. You can list these open files and directories using the lsof command.

In this tutorial, we will learn how to use the lsof command in Linux to list open files using examples.

Prerequisites

• A Linux computer with terminal access.
• Some familiarity with Linux/UNIX commands.
• Root user or sudo privileges to list root-owned files.
• Willingness to learn new commands

Lsof Command

The lsof command stands for list open files, is used to list all open files and directories. This command helps you find out which files are opened by various processes, the user’s process list, and the list of processes listening on a particular port. You can also use this command to debug disk unmounting errors that are caused when the files are in use by other processes.

The lsof command lists not only the regular files, but also lists shared libraries, block special files, regular pipes, named pipes, character special files, UNIX domain, Internet sockets, file system mount points, and disk files. Use the lsof command with its options or the grep command to filter out the results.

lsof command requires root or sudo access as most processes or devices it lists belonged to root.

By default, the lsof command is automatically installed with all major Linux distributions. However, if it is not available in your distribution, then you need to first install the command to try these examples.

Syntax

This is the basic syntax of the lsof command:

lsof [option] [username]

How to Use Linux Lsof Command

The lsof command can be used in different ways, with or without additional options. When used without options, it lists hundreds of files that are currently open. The options help you narrow down the search results. For example, pass the directory as an option to list all the files that are opened from a directory and the processes that opened those files.

If you run the lsof command as a regular user, not the root user, then you will see several “permission denied” errors because many system files and processes are restricted only to the root user.

Lsof Options

The lsof command provides a number of options to filter out the file lists. The following table describes some of the most commonly used lsof options:

Linux Lsof Command Examples

The lsof command provides various options to narrow down the search results when listing the open files. The following Linux lsof command examples will show you some of the most common use cases of this command.

List All Open Files

Use the lsof command without any options to list all the open files on your Linux computer:

lsof

The lsof output is usually very long and you can use lsof | more to display one screen output at a time to make it more readable.

List Files Opened by a Specific User

Several users can access a Linux computer at a given time. Every user has different file and device requirements. To list the files that are opened by a particular user, type:

lsof -u tom

You can also use lsof to display output for multiple users in a single command, such as:

lsof -u username1, username2

Or, you can list all the files that are opened by all the users except for the specified user. For example, to display all the files that are not opened by the root user, type:

lsof -u^root

List Files Opened By a Process

A Linux process may use several files at a time to complete its operations. The following command helps you list open files used by a particular process:

lsof -c network

You can also use the PID or process identification number, instead of the process name to list files opened by a particular process ID:

lsof -p 11

To list open files for multiple process IDs in a single command, type:

lsof -p PID1, PID2, PID3

Filter Open Files by Filename

Use the filename as an argument to list all the processes that have opened the specified file:

lsof /var/log

List all Files Opened by a Directory

To list all the files that are opened by a particular directory, supply the directory name as an argument of lsof:

sudo lsof +D /var/log

List Files Opened by a Network Protocol

Linux supports multiple network connections to connect to different applications and devices. We can use the -i option to list all the files used by a particular network protocol.

For example, use the following command to list the UDP protocol files:

lsof -i UDP

Similarly, we can use lsof -i TCP to list all TCP protocol files.

List Files Used by Processes Running on Specific Port

Some Linux applications and processes require a specific port to establish a connection. To list all the open files that are used by the processes running on port 631, type:

sudo lsof -i :631

We can also list multiple port numbers, such as lsof –i :22,443 Or, specify a TCP port range along with the network protocol, such as lsof -i TCP:1-44653.

List Files Opened by IPv4 and IPv6

The following examples show you the open IPv4 network connections files:

sudo lsof -i 4

To list open IPv6 files, type:

sudo lsof -i 6

Linux Lsof Command Headers

The output of the lsof command is organized in a tabular form to help you better understand the files and processes that are using them. The following table lists and describes the lsof command headers:

Conclusion

In this tutorial, we learned how to list all open files on a Linux computer using lsof. This command comes with multiple options that you can use to sort out the files based on your requirements. The lsof command does not impact the files, so it is completely safe to use this command.

For more information browse lsof manual page or type lsof --help on the terminal.

If this resource helped you, let us know your care by a Thanks Tweet. Tweet a thanks

Did you find this article helpful?

We are glad you liked the article. Share with your friends.

Sorry about that.

How can we improve it?