An overview of the Linux “lsof” command
The lsof command stands for List Open Files and shows open files and which process uses them.
In Linux, everything is in the form of files. Sometimes, especially for troubleshooting purposes, we need to know which files are currently used by what processes, and also we can check the files that are opened by some network connections in the system and so on.
>> lsof | more
COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 252,1 4096 2 /
systemd 1 root rtd DIR 252,1 4096 2 /
systemd 1 root txt REG 252,1 1620224 3318 /usr/lib/systemd/systemd
systemd 1 root mem REG 252,1 1369384 4764 /usr/lib/x86_64-linux-gnu/libm-2.31.so
systemd 1 root mem REG 252,1 178528 4736 /usr/lib/x86_64-linux-gnu/libudev.so.1.6.
…
…
Let’s see some of the important options we can use along with lsof command.
● Filter open folder by username
# Filter open files by username
>> lsof -u root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 252,1 4096 2 /
systemd 1 root rtd DIR 252,1 4096 2 /
systemd 1 root txt REG 252,1 1620224 3318 /usr/lib/systemd/systemd
…
# Filter open files by except a particular username
>> lsof -u ^root
COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-n 401 systemd-network cwd DIR 252,1 4096 2 /
systemd-n 401 systemd-network rtd DIR 252,1 4096 2 /
…
● Filter open files by a particular process
# Filter open files by a particular process
>> lsof -c nginx
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 23267 root cwd DIR 252,1 4096 2 /
nginx 23267 root rtd DIR 252,1 4096 2 /
nginx 23267 root txt REG 252,1 1195152 77095 /usr/sbin/nginx
● Filter open files by a process ID
# Filter open files by a process ID
>> lsof -p 23267
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 23267 root cwd DIR 252,1 4096 2 /
nginx 23267 root rtd DIR 252,1 4096 2 /
nginx 23267 root txt REG 252,1 1195152 77095 /usr/sbin/nginx
nginx 23267 root mem REG 252,1 180792 786469 /usr/lib/nginx/modules/ngx_stream_module.so
● Filter open files by a Directory. It lists out the files which are opened by a particular directory.
# Filter open files by a Directory
>> lsof +D /usr/bin
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
dbus-daem 548 messagebus txt REG 252,1 249032 1660 /usr/bin/dbus-daemon
networkd- 559 root txt REG 252,1 5502744 1614 /usr/bin/python3.8
bash 21135 root txt REG 252,1 1183448 1572 /usr/bin/bash
● Filter open files by network connection.
# Filter open files by network connection
>> lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-n 401 systemd-network 19u IPv4 25326 0t0 UDP 172.30.1.2:bootpc
sshd 632 root 3u IPv4 20842 0t0 TCP *:ssh (LISTEN)
sshd 632 root 4u IPv6 20853 0t0 TCP *:ssh (LISTEN)
container 13459 root 12u IPv4 43290 0t0 TCP localhost:46111 (LISTEN)
node 21195 root 18u IPv4 52391 0t0 TCP *:40205 (LISTEN)
● Filter open files by port.
# Filter open files port
>> lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 23267 root 6u IPv4 66992 0t0 TCP *:http (LISTEN)
nginx 23267 root 7u IPv6 66993 0t0 TCP *:http (LISTEN)
nginx 23268 www-data 6u IPv4 66992 0t0 TCP *:http (LISTEN)
nginx 23268 www-data 7u IPv6 66993 0t0 TCP *:http (LISTEN)
● Filter open files by protocol.
# Filter open files by protocol
>> lsof -i TCP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 632 root 3u IPv4 20842 0t0 TCP *:ssh (LISTEN)
sshd 632 root 4u IPv6 20853 0t0 TCP *:ssh (LISTEN)
container 13459 root 12u IPv4 43290 0t0 TCP localhost:46111 (LISTEN)
node 21195 root 18u IPv4 52391 0t0 TCP *:40205 (LISTEN)
node 21195 root 19u IPv4 59053 0t0 TCP 172.30.1.2:40205->10.244.5.61:35534 (ESTABLISHED)
kc-termin 21208 root 11u IPv4 52388 0t0 TCP *:40200 (LISTEN)
kc-termin 21208 root 12u IPv4 59028 0t0 TCP 172.30.1.2:40200->10.244.3.164:51234 (ESTABLISHED)
sshd 21229 root 4u IPv4 52517 0t0 TCP 172.30.1.2:ssh->10.48.0.6:44226 (ESTABLISHED)
systemd-r 21460 systemd-resolve 13u IPv4 55313 0t0 TCP 127.0.0.53:domain (LISTEN)
runtime-s 21532 root 3u IPv6 55949 0t0 TCP *:40300 (LISTEN)
runtime-i 21567 root 3u IPv6 56441 0t0 TCP *:40305 (LISTEN)
app1 21971 root 3u IPv4 59009 0t0 TCP *:1234 (LISTEN)