Today we are going to explain 15 practical examples of lsof command.
Linux command lsof stands for list open files.
As per the name, it is used to list out the open files name which are opened by processes.
This command is more useful, especially when we are doing some operation and getting messages operation can’t process due to specific files are already in use. So by using the lsof command, we can quickly identify which files are used by which process.
Suggested Reading: Linux lsof command syntax
Let’s start the examples of practical usages of the lsof command.
List all open files
To list all opened files in the system type “lsof” command on terminal and hit enter as shown below.
The output of the command is very simple.
The first column shows command which has executed.
2nd column show process id which has run the command.
The 3rd column is to identify the user, who has run the process.
4th column if for the File Descriptor. Some of the value of FDs are:
• cwd – Current Working Directory
• txt – Test file
• mem – Memory mapped file
• mmap – Memory mapped device
• NUMBER – Represent the actual file descriptor. Here one character coming after the number, i.e., ‘1r’, representing the mode of opened file. R is for read, w is for write and u is for read and write.
The 5th column is representing the type of file; some of the values of this column are:
• REG – Regular File
• DIR – Directory
• FIFO – First In First Out
• CHR – Character special file
6th column is to identify the device used for the file or process.
7th column is showing the size of the file.
8th column is representing Node.
9th column is showing the name of the file or device.
List opened files belongs to a specific user
You can find all opened files list which are used by specific user’s process.
The above command will give you output for a list of all open files of user linuxconcept, as shown below.
List all open files by a specific process
You can list out all opened file used by the specific process by using the “-p” command line argument with the lsof command, as shown below.
The above command will list out the opened filed used by a process whose process ID is 5673.
List process which opened a specific file
You can also find the process that has opened any specific file, as shown below.
The above command will list out the all process ID using the file “home/linuxconcpet/test.sh”, as given below output.
List opened files under a specific directory
You can also find the list of opened file from a particular directory, using “+D” command line argument with a path of a directory, as shown below.
The above command will list all opened files from directory “/home/linuxconcept” as below output.
List opened files based on process names starting with
Sometime you may don’t know the full name of a process, but you aware about process name like some start with the character of the process name. In this case, also you list out all opened files based on process names starting with character or substring.
To do this, use the “-c” option with the command, as shown below.
The above command will list all files which used with any process whose name starts with ssh.
List opened files based on their Internet address
The “lsof” tool allows you to list files based on their Internet address. To do this use “-I” command line option, as shown below.
For IPv4 address, use the following command:
For IPv6 address, use the following command:
List all Internet and x.25 network files
To list all internet file with any versions of IP address, use the following command.
List all opened files for a process running on a specific port
You can also find all running process of a specific port, using “- i” command line option with specifying the port number and protocol as shown below.
List all opened files based on port range
The “lsof” utility also provides the functionalities to pass the range of ports to find the running processes on the given port range. To do this, use the following command:
List all opened files based on the type of connections (TCP/UDP)
To list all running processes and opened files with specifying the connection type of protocol use following command:
List all opened files for Parent PID of processes
The “lsof” tool provides the option to find the open file list the parent process identification (PPID) number in the output, using the “-R” command line option.
To get the PPID information for the specific process ID, use the following command:
Exclude specific user’s process opened file information
Where you are listing opened files for the user, you can also list the opened file list with excluding any user by using “^” character, as shown below.
The above command list all opened file excluding those are related with “root” user.
List all Network File System (NFS) files
The “lsof” utility provides the option to list all the NFS files by using the “-N” option, as shown below.
The above command will list all NFS files use by the linuxconcept user.
Kill all process belongs to a specific user
The “lsof” tool, you can use to delete all process or activities of a user, as shown below.
The above command will kill all the process run by the user linuxconcept.