Back to Commands

lsof

system informationLinux/Unix

The lsof command is one of the most frequently used commands in Linux/Unix-like operating systems. lsof List open files

See Examples View Syntax

Quick Reference

Command Name:

lsof

Category:

system information

Platform:

Linux/Unix

Basic Usage:

lsof [options] [arguments]

Common Use Cases

Syntax

lsof [options]

Options

Option	Description
`-a`	Use AND logic between options instead of OR logic
`-c command`	Select processes with command names starting with string
`-d FD`	Select by file descriptor number or range
`-D directory`	Use this directory's contents for device cache
`-i [protocol][@host][:port]`	Select files used for Internet connections
`-l`	Don't convert UIDs to usernames
`-n`	Don't convert network addresses to hostnames
`-p PID`	Select files for process with specified PID
`-P`	Don't convert port numbers to service names
`-r seconds`	Repeat the listing every specified seconds
`-t`	Show only PIDs (terse output)
`-u username`	Select files for processes owned by user
`-U`	Show only UNIX domain socket files
`-F format`	Specify output format for processing by programs
`+D directory`	Recursively list all files in a directory
`+L`	List open files with link counts less than 1

Examples

How to Use These Examples

The examples below show common ways to use the lsof command. Try them in your terminal to see the results. You can copy any example by clicking on the code block.

# Basic Examples Basic

lsof

List all open files on the system.

lsof /var/log/syslog

Show processes that have the specified file open.

# Advanced Examples Advanced

lsof -u username List files opened by a specific user. lsof -i :22 Show processes using port 22 (SSH). lsof -i tcp List all TCP connections. lsof -p 1234 Show files opened by process ID 1234. lsof -c apache Show files opened by processes with names starting with "apache". lsof -t /var/log/syslog Show only the PIDs of processes that have the file open. lsof +D /var/log List all open files in the /var/log directory and its subdirectories. lsof -i -u root -a Show network connections opened by the root user (using AND logic). lsof -i @192.168.1.1 Show connections to/from a specific IP address.

Try It Yourself

Practice makes perfect! The best way to learn is by trying these examples on your own system with real files.

Understanding Syntax

Pay attention to the syntax coloring: commands, options, and file paths are highlighted differently.

Notes

The 'lsof' (list open files) command is a powerful diagnostic utility for Unix and Linux systems that provides information about files that are open by processes running on the system. In Unix-like operating systems, where "everything is a file," lsof can reveal a wealth of information about the system's state, including regular files, directories, block devices, network sockets, pipes, and more. Key features of the lsof command: 1. Comprehensive File Listing: lsof can display all open files on the system, showing which processes are accessing which files at any given time. 2. Network Connection Monitoring: The command can show network connections (TCP, UDP) including local and remote addresses and ports, making it invaluable for network troubleshooting. 3. Process-specific File Usage: lsof can filter by process ID, user, command name, or file descriptor, allowing focused investigation of specific processes. 4. File System Analysis: The command helps identify which processes are keeping files open on filesystems, which is useful when trying to unmount file systems or troubleshoot disk space issues. 5. Security Monitoring: lsof can reveal unauthorized network connections or file access, aiding in security investigations. 6. Deleted File Recovery: It can identify processes that still have open file handles to deleted files, allowing recovery of file contents or freeing of disk space. 7. Versatile Filtering: lsof offers numerous options to filter its output, making it adaptable to many troubleshooting scenarios. The typical output of lsof includes: - COMMAND: The name of the command or process - PID: Process ID - USER: User name - FD: File descriptor (e.g., current working directory, standard input/output, memory-mapped files) - TYPE: Type of file (e.g., regular file, directory, socket) - DEVICE: Device numbers - SIZE/OFF: Size of the file or offset into the file - NODE: Inode number - NAME: Name of the file or network connection details Common use cases for lsof include: - Identifying processes preventing unmounting of file systems - Discovering which process is listening on a specific port - Troubleshooting network connection issues - Finding processes accessing specific files - Diagnosing "file in use" errors when trying to delete or modify files - Monitoring system resource usage and potential leaks - Investigating security incidents lsof is particularly valuable for system administrators, security professionals, and developers who need to understand and troubleshoot complex system interactions. Its extensive capabilities make it one of the most versatile diagnostic tools available on Unix-like systems.

Related Commands

These commands are frequently used alongside lsof or serve similar purposes:

Explore All Commands

Use Cases

Learn By Doing

The best way to learn Linux commands is by practicing. Try out these examples in your terminal to build muscle memory and understand how the lsof command works in different scenarios.

See Examples Try Lab Exercises

$ lsof

View All Commands