15 Practical examples of lsof command

LinuxConcept - 15 Practical examples of lsof command image

Today we are going to explain 15 practical examples of lsof command.

Linux command lsof stands for list open files.

As per the name, it is used to list out the open files name which are opened by processes.

This command is more useful, especially when we are doing some operation and getting messages operation can’t process due to specific files are already in use. So by using the lsof command, we can quickly identify which files are used by which process.

Suggested Reading: Linux lsof command syntax

Let’s start the examples of practical usages of the lsof command.

List all open files

To list all opened files in the system type “lsof” command on terminal and hit enter as shown below.

# lsof
COMMAND  PID       USER   FD      TYPE     DEVICE  SIZE/OFF       NODE NAME
init       1       root  cwd       DIR        8,1      4096          2 /
init       1       root  txt       REG        8,1    167704     967862 /sbin/init
init       1       root    0u      CHR        1,3       0t0       4369 /dev/null
init       1       root    1u      CHR        1,3       0t0       4369 /dev/null
init       1       root    2u      CHR        1,3       0t0       4369 /dev/null
init       1       root    3r     FIFO        0,8       0t0       6323 pipe
...

The output of the command is very simple.

The first column shows command which has executed.

2nd column show process id which has run the command.

The 3rd column is to identify the user, who has run the process.

4th column if for the File Descriptor. Some of the value of FDs are:

  • cwd – Current Working Directory
  • txt – Test file
  • mem – Memory mapped file
  • mmap – Memory mapped device
  • NUMBER – Represent the actual file descriptor. Here one character coming after the number, i.e., ‘1r’, representing the mode of opened file. R is for read, w is for write and u is for read and write.

The 5th column is representing the type of file; some of the values of this column are:

  • REG – Regular File
  • DIR – Directory
  • FIFO – First In First Out
  • CHR – Character special file

6th column is to identify the device used for the file or process.

7th column is showing the size of the file.

8th column is representing Node.

9th column is showing the name of the file or device.

List opened files belongs to a specific user

You can find all opened files list which are used by specific user’s process.

$ lsof  - u <username>
$ lsof  - u linuxconcept

The above command will give you output for a list of all open files of user linuxconcept, as shown below.

linuxconcept@linuxconcept.com:~$ lsof -u linuxconcept
COMMAND   PID   USER        FD      TYPE             DEVICE SIZE/OFF       NODE NAME
sshd     7078 linuxconcept  cwd   unknown                                        /proc/7078/cwd (readlink: Permission denied)
sshd     7078 linuxconcept  rtd   unknown                                        /proc/7078/root (readlink: Permission denied)
bash     7081 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
bash     7081 linuxconcept  txt       REG                8,1  1037528    9175042 /bin/bash
bash     7081 linuxconcept    0u      CHR              136,0      0t0          3 /dev/pts/0
systemd 14168 linuxconcept  cwd       DIR                8,1     4096          2 /
systemd 14168 linuxconcept  txt       REG                8,1  1577232    7864790 /lib/systemd/systemd
systemd 14168 linuxconcept  mem       REG                8,1    47600    7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
systemd 14168 linuxconcept    0r      CHR                1,3      0t0          6 /dev/null
systemd 14168 linuxconcept    1u     unix 0x0000000000000000      0t0     282381 type=STREAM
(sd-pam 14171 linuxconcept  cwd   unknown                                        /proc/14171/cwd (readlink: Permission denied)
bash    14176 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
bash    14176 linuxconcept  rtd       DIR                8,1     4096          2 /
bash    14176 linuxconcept  txt       REG                8,1  1037528    9175042 /bin/bash
bash    14176 linuxconcept  mem       REG                8,1    35688    7864881 /lib/x86_64-linux-gnu/libnss_compat-2.23.so
bash    14176 linuxconcept    0u      CHR                4,1      0t0         20 /dev/tty1
lsof    22325 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
lsof    22325 linuxconcept  rtd       DIR                8,1     4096          2 /

List all open files by a specific process

You can list out all opened file used by the specific process by using the “-p” command line argument with the lsof command, as shown below.

$ lsof  - p  <PID>
$ lsof  - p  1558

The above command will list out the opened filed used by a process whose process ID is 5673.

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -p 1558
COMMAND    PID  USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAME
ossec-age 1558 ossec  cwd    DIR                8,1     4096    8791672 /var/ossec
ossec-age 1558 ossec  rtd    DIR                8,1     4096    8791672 /var/ossec
ossec-age 1558 ossec  mem    REG                8,1    47600    7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
ossec-age 1558 ossec  mem    REG                8,1   162632    7864797 /lib/x86_64-linux-gnu/ld-2.23.so
ossec-age 1558 ossec    0u   CHR                1,3      0t0          6 /dev/null
ossec-age 1558 ossec    3r   REG                0,4        0 4026531991 /proc/uptime
ossec-age 1558 ossec    4r   REG                0,4        0 4026531990 /proc/stat
ossec-age 1558 ossec    6u  unix 0xffff880c22f69800      0t0      27895 /queue/ossec/queue type=DGRAM
ossec-age 1558 ossec    9u  IPv4              34028      0t0        UDP 195-154-45-207.rev.poneytelecom.eu:34849->ip207.ip-5-196-165.eu:1514
ossec-age 1558 ossec   10u  unix 0xffff880622a96000      0t0      34029 type=DGRAM

List process which opened a specific file

You can also find the process that has opened any specific file, as shown below.

$ lsof  -t <file-name>
$ lsof  -t /home/linuxconcept/test.sh

The above command will list out the all process ID using the file “home/linuxconcpet/test.sh”, as given below output.

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -t /home/linuxconcept/test.sh
2465
2467

List opened files under a specific directory

You can also find the list of opened file from a particular directory, using “+D” command line argument with a path of a directory, as shown below.

$ lsof +D <Directory-path>
$ lsof +D /lib/systemd/

The above command will list all opened files from directory “/home/linuxconcept” as below output.

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof +D /lib/systemd/
COMMAND    PID             USER  FD   TYPE DEVICE SIZE/OFF    NODE NAME
systemd      1             root txt    REG  252,0  1577232 6291777 /lib/systemd/systemd
systemd-j  517             root txt    REG  252,0   326224 6291791 /lib/systemd/systemd-journald
systemd-u  649             root txt    REG  252,0   453240 6291810 /lib/systemd/systemd-udevd
systemd-t  986 systemd-timesync txt    REG  252,0   141904 6291809 /lib/systemd/systemd-timesyncd
systemd-l 1152             root txt    REG  252,0   618520 6291793 /lib/systemd/systemd-logind
systemd   1465           satish txt    REG  252,0  1577232 6291777 /lib/systemd/systemd
(sd-pam   1467           satish txt    REG  252,0  1577232 6291777 /lib/systemd/systemd

List opened files based on process names starting with

Sometime you may don’t know the full name of a process, but you aware about process name like some start with the character of the process name. In this case, also you list out all opened files based on process names starting with character or substring.

To do this, use the “-c” option with the command, as shown below.

$ lsof  -c <starting string of process>
$ lsof  -c ssh

The above command will list all files which used with any process whose name starts with ssh.

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -c ssh
COMMAND   PID   USER   FD   TYPE             DEVICE SIZE/OFF      NODE NAME
sshd     1284   root  cwd    DIR              252,0     4096         2 /
sshd     1284   root  txt    REG              252,0   791024   1056451 /usr/sbin/sshd
sshd     1284   root  mem    REG              252,0    47600   6292021 /lib/x86_64-linux-gnu/libnss_files-2.23.so
sshd     1284   root  mem    REG              252,0  1868984   6291957 /lib/x86_64-linux-gnu/libc-2.23.so
sshd     1284   root    0r   CHR                1,3      0t0         6 /dev/null
sshd     1284   root    1u  unix 0xffff88079b1bf800      0t0     16819 type=STREAM
sshd     1284   root    4u  IPv6              62746      0t0       TCP *:ssh (LISTEN)
sshd    28071   root  cwd    DIR              252,0     4096         2 /
sshd    28071   root  mem    REG              252,0   101200   6292048 /lib/x86_64-linux-gnu/libresolv-2.23.so
sshd    28071   root    0r   CHR                1,3      0t0         6 /dev/null
sshd    28071   root    3u  IPv4          790303210      0t0       TCP sendy01.dataaegis.com:ssh->36.255.86.76:62437 (ESTABLISHED)
sshd    28154 satish  txt    REG              252,0   791024   1056451 /usr/sbin/sshd
sshd    28154 satish    3u  IPv4          790303210      0t0       TCP sendy01.dataaegis.com:ssh->36.255.86.76:62437 (ESTABLISHED)
sshd    28154 satish    4u  unix 0xffff880797e46400      0t0 790304811 type=DGRAM
sshd    28154 satish    5u  unix 0xffff880797e40000      0t0 790304817 type=STREAM
sshd    28154 satish    6r  FIFO               0,10      0t0 790302071 pipe
sshd    28154 satish    7w  FIFO               0,18      0t0       254 /run/systemd/sessions/21627649.ref

List opened files based on their Internet address

The “lsof” tool allows you to list files based on their Internet address. To do this use “-I” command line option, as shown below.

For IPv4 address, use the following command:

$ lsof  -i 4

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i 4
COMMAND     PID   USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
sshd       1284   root    3u  IPv4     62744      0t0  TCP *:ssh (LISTEN)
zabbix_ag 19709 zabbix    5u  IPv4  30184274      0t0  TCP *:zabbix-agent (LISTEN)
zabbix_ag 19720 zabbix    5u  IPv4  30184274      0t0  TCP *:zabbix-agent (LISTEN)
sshd      28071   root    3u  IPv4 790303210      0t0  TCP sendy01.dataaegis.com:ssh->36.255.86.76:62437 (ESTABLISHED)

For IPv6 address, use the following command:

$ lsof  -i 6

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i 6
COMMAND     PID     USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
sshd       1284     root    4u  IPv6     62746      0t0  TCP *:ssh (LISTEN)
apache2    2094 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2    2094 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)
apache2    7464 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2    7464 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)

List all Internet and x.25 network files

To list all internet file with any versions of IP address, use the following command.

$ lsof  -i

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i
COMMAND     PID     USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
sshd       1284     root    3u  IPv4     62744      0t0  TCP *:ssh (LISTEN)
apache2    2094 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2    2094 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)
apache2   17187 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2   17187 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)
zabbix_ag 19709   zabbix    5u  IPv4  30184274      0t0  TCP *:zabbix-agent (LISTEN)
zabbix_ag 19709   zabbix    6u  IPv6  30184275      0t0  TCP *:zabbix-agent (LISTEN)
mysqld    29560    mysql   33u  IPv6  33287863      0t0  TCP *:mysql (LISTEN)
apache2   29687 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2   29687 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)

List all opened files for a process running on a specific port

You can also find all running process of a specific port, using “- i” command line option with specifying the port number and protocol as shown below.

$ lsof  -i  TCP:22

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i TCP:22
COMMAND   PID   USER            FD   TYPE    DEVICE SIZE/OFF NODE NAME
sshd     1284   linuxconcept    3u  IPv4     62744      0t0  TCP *:ssh (LISTEN)
sshd     1284   linuxconcept    4u  IPv6     62746      0t0  TCP *:ssh (LISTEN)

List all opened files based on port range

The “lsof” utility also provides the functionalities to pass the range of ports to find the running processes on the given port range. To do this, use the following command:

$ lsof   -i  :50-500

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i :50-500
COMMAND   PID     USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
apache2  2096 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2  2096 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)
apache2  2527 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2  2527 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)

List all opened files based on the type of connections (TCP/UDP)

To list all running processes and opened files with specifying the connection type of protocol use following command:

$ lsof  -i  udp
$ lsof  -i  tcp

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i udp
linuxconcept@linuxconcept.com:/home/linuxconcept#
linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i tcp
COMMAND     PID     USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
sshd       1284     root    3u  IPv4     62744      0t0  TCP *:ssh (LISTEN)
sshd       1284     root    4u  IPv6     62746      0t0  TCP *:ssh (LISTEN)
apache2    2096 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2    2096 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)
apache2    2527 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2    2527 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)

List all opened files for Parent PID of processes

The “lsof” tool provides the option to find the open file list the parent process identification (PPID) number in the output, using the “-R” command line option.

$ lsof  -R

To get the PPID information for the specific process ID, use the following command:

$ lsof  -p <PID>  -R
$ lsof  -p 2356  -R

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -p 31522 -R
COMMAND   PID PPID USER   FD   TYPE    DEVICE SIZE/OFF      NODE NAME
apache2 31522    1 root  cwd    DIR     252,0     4096         2 /
apache2 31522    1 root  txt    REG     252,0   662560   1056655 /usr/sbin/apache2
apache2 31522    1 root  DEL    REG       0,5          784145000 /dev/zero
apache2 31522    1 root  mem    REG     252,0    23360   2623397 /usr/lib/php/20151012/enchant.so
apache2 31522    1 root  mem    REG     252,0    88168   2623384 /usr/lib/php/20151012/curl.so
apache2 31522    1 root  mem    REG     252,0    14440   2622733 /usr/lib/php/20151012/ctype.so
apache2 31522    1 root  mem    REG     252,0    36048   2622725 /usr/lib/php/20151012/calendar.so
apache2 31522    1 root  DEL    REG       0,5          784145001 /dev/zero
apache2 31522    1 root    0r   CHR       1,3      0t0         6 /dev/null
apache2 31522    1 root    2w   REG     252,0 10750047   2630025 /var/log/apache2/error.log
apache2 31522    1 root    3u  sock       0,8      0t0 709661640 protocol: TCP
apache2 31522    1 root    4u  IPv6 709661641      0t0       TCP *:http (LISTEN)
apache2 31522    1 root    8w  FIFO      0,10      0t0 784144998 pipe
apache2 31522    1 root   32r   CHR       1,9      0t0        11 /dev/urandom

Exclude specific user’s process opened file information

Where you are listing opened files for the user, you can also list the opened file list with excluding any user by using “^” character, as shown below.

$ lsof  -i  -u^root

The above command list all opened file excluding those are related with “root” user.

linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -i -u^root
COMMAND     PID     USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
apache2    2527 www-data    4u  IPv6 709661641      0t0  TCP *:http (LISTEN)
apache2    2527 www-data    6u  IPv6 709661645      0t0  TCP *:https (LISTEN)
sshd       9091     sshd    3u  IPv4 790526598      0t0  TCP sendy01.dataaegis.com:ssh->218.92.0.197:44360 (ESTABLISHED)
zabbix_ag 19720   zabbix    5u  IPv4  30184274      0t0  TCP *:zabbix-agent (LISTEN)
zabbix_ag 19720   zabbix    6u  IPv6  30184275      0t0  TCP *:zabbix-agent (LISTEN)
sshd      28154   satish    3u  IPv4 790303210      0t0  TCP sendy01.dataaegis.com:ssh->36.255.86.76:62437 (ESTABLISHED)
mysqld    29560    mysql   33u  IPv6  33287863      0t0  TCP *:mysql (LISTEN)

List all Network File System (NFS) files

The “lsof” utility provides the option to list all the NFS files by using the “-N” option, as shown below.

$ lsof  -N  -u  linuxconcept  -a

The above command will list all NFS files use by the linuxconcept user.

Kill all process belongs to a specific user

The “lsof” tool, you can use to delete all process or activities of a user, as shown below.

$ kill -9  `lsof  -t  -u  linuxconcpet`

The above command will kill all the process run by the user linuxconcept.

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Related Articles