How To Use Lsof Command In Linux.
This article will explain how to use the lsof command in Linux with examples.
The lsof command stands for LiSt Open Files and shows open files and which process uses them. Since Linux sees every object as a file, such as devices, directories, etc., unidentified open files prevent users from modifying them.
lsof Command Syntax
The lsof command syntax is:
lsof Command Options
The lsof command has many of options. The table below includes arguments that are used most often:
Lists all open files.
Suppresses kernel blocks.
/ [file system] /
Shows open files in a particular file system.
Displays files associated with the terminal.
Prints all files opened by a user.
Prints all files opened by everyone except a specific user.
Lists all files accessed by a particular process.
-p [process ID]
Shows all open files associated with a specific process ID.
-p ^[process ID]
Shows files opened by all other PIDs.
Lists parent process IDs.
+D [directory path]
Prints all open files in a directory.
Displays all files accessed by network connections.
-i [IP version number]
Filters files based on their IP.
Filters open files based on the connection type (TCP or UDP).
-i :[port number]
Finds processes running on a specific port.
-i :[port range]
Finds processes running on specific port ranges.
-t [file name]
Lists IDs of processes that have accessed a particular file.
# kill -9 ‘lsof -t -u [user]’
Kills all user processes.
Shows all memory-mapped files.
[path] | grep deleted
Prints locked deleted files.
Opens the man page.
lsof Command Examples
lsof incorporates different arguments allowing users to manage system and network administration activities. Outlined below are the most common lsof use cases.
List All Files
When run without any options, lsof lists all files opened by any process:
The lsof command outputs a lot of details. Therefore, always pipe lsof with less to display the output one page at a time.
To navigate to the bottom of the list, hit Enter or down arrow. Exit the list with Q.
lsof output consists of different columns. However, not all columns apply to every type of file. The header looks like this:
The default columns in the lsof output are:
COMMAND – Refers to the command associated with the process that opened the file.
PID – The process identification number of the process running the file.
TID – Represents a task identification number for the respective process. It is blank if a process, not a task, has opened the file.
TASKCMD – Refers to the command name in the first column. However, TASKCMD can differ when a task changes its command name.
USER – Names the user executing the process. The column contains the User ID or name.
FD – Is the file descriptor the process uses to associate with the file.
TYPE – Shows the type of file and its identification number.
DEVICE – Prints device numbers related to the file.
SIZE/OFF – Represents the value or the file taken during the runtime (size or offset).
NODE – The local file’s node number or inode number of the directory/parent directory.
NAME – Shows the path or link to the file.
Conceal Kernel Blocks
The default lsof output also includes files that are opened by the kernel. To suppress kernel blocks, run lsof with the -b flag:
Display Files of a Specific Filesystem
Use the lsof command to show open files in a particular file system:
For example, to see all open files in the sys directory, run:
Print Terminal Files
List all open files connected to the terminal by targeting the dev directory with lsof:
Use lsof with a -u flag to display files opened by a specific user:
The output shows files controlled by users other than root.
Display Files Used by a Process
The -c flag opens all files used by a process:
For example, to list files opened by the wpa_suppl process, run:
nother option is to use only a part of the program name:
lsof returns all programs starting with the term wpa, which includes wpa_suppl.
Moreover, the -c option gives the same output as piping lsof with grep:
Print Files Opened by a Specific PID
Use the -p option to filter specific files by the Process ID number (PID). For example, the output below shows all files with PID 635.
On the other hand, add a caret ^ symbol to print files opened by all other processes:
Additionally, combining lsof with the -R flag adds the Parent Process Identification Number (PPID) to the output.
To get PPID info for a specific PID, execute:
For example, to get the PPID for the 635 PID, type:
The output shows the PPID column added to the header.
Show Files Under a Directory
To see all files that have been opened under a directory, use the following command:
This option also recurses the sub directories. To avoid recursing, use the +d flag.
Show Files Accessed by Network Connections
Use the -i flag with lsof to check which files are opened by a network connection. Execute this command:
The example above prints files open by a network connection, regardless of the connection type.
The -i flag adds a lot of versatility to lsof, allowing users to filter files based on different criteria. Use lsof -i [options] to:
Filter files based on their IP with:
For example, run this command to display only IPv4 files:
On the contrary, print only IPv6 files with:
See only files that use tcp or udp connection by providing the protocol type:
Find processes running on a specific port. This option is useful to check which file is preventing another app from binding to a specific port. Execute the command with the port number or service name from the name column:
Print all files open on specific port ranges.
List IDs of Processes Holding Open Files
To see PIDs for processes that have opened a particular file, use -t and provide the file name.
Kill All User’s Processes
The -t flag also kills all processes by a specific user. For example, to kill all processes by user notsara, execute this command as root:
Print All Memory-Mapped Files
lsof prints which processes have memory-mapped files. To show these processes, run:
Display Locked Deleted Files
A process sometimes keeps big files locked even after they have been deleted, consuming disk space.
Use Lsof to find files that are deleted in Linux but are still locked by one or more processes.
For example, find deleted files from the root directory using a slash (/) as a path symbol:
Combine Multiple Options
The lsof command allows multiple search items on the command line. Use AND and OR logic to combine different arguments to get specific results. Below are most common examples.
List files open by a particular user or process with:
Display only files that match the first search term and the second search term with the logical operator -a (and):
In this case, lsof shows only files opened by the user root and the bash process.
Find all network connections of a user:
To explore the command’s possibilities, run:
This tutorial shows you how to use the lsof command for troubleshooting potential security and system problems with practical examples.