Linux command lsof stands for list all open files.
The lsof command used to get the information of all open files by processes.
If you want to know which files are open by some specific process (or all processes), you can use the Linux command lsof; it will give all information in terms of open files by the processes.
An open file could be any types of file, regular file, directory, library file, character special file, block special file, or network or stream files.
$ lsof <options>Suggested Reading: Linux lsof command structure
Examples of lsof command:
Check all open files in system by process
To check all open files in system run “lsof” command without any option and arguments as shown below.
$ lsofOutput:
linuxconcept@linuxconcept.com:~# lsof
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 8,1 4096 2 /
systemd 1 root rtd DIR 8,1 4096 2 /
systemd 1 root txt REG 8,1 1577232 7864790 /lib/systemd/systemd
systemd 1 root mem REG 8,1 18976 7864946 /lib/x86_64-linux-gnu/libuuid.so.1.3.0
systemd 1 root mem REG 8,1 262408 7864939 /lib/x86_64-linux-gnu/libblkid.so.1.1.0
systemd 1 root mem REG 8,1 14608 7864835 /lib/x86_64-linux-gnu/libdl-2.23.so
systemd 1 root mem REG 8,1 461072 7869350 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
systemd 1 root mem REG 8,1 1868984 7864821 /lib/x86_64-linux-gnu/libc-2.23.so
systemd 1 root mem REG 8,1 138696 7864908 /lib/x86_64-linux-gnu/libpthread-2.23.so
systemd 1 root mem REG 8,1 286824 7864435 /lib/x86_64-linux-gnu/libmount.so.1.1.0
systemd 1 root mem REG 8,1 64144 7864433 /lib/x86_64-linux-gnu/libapparmor.so.1.4.0
systemd 1 root mem REG 8,1 92864 7864859 /lib/x86_64-linux-gnu/libkmod.so.2.3.0
systemd 1 root mem REG 8,1 117288 7864813 /lib/x86_64-linux-gnu/libaudit.so.1.0.0Check all open files opened by process belongs to a user
The lsof tool allows us to check files information opened by the process which belongs to a specific user by using “-u” command line option as shown below.
$ lsof –u <username>
$ lsof -u linuxconceptOutput:
linuxconcept@linuxconcept.com:~$ lsof -u linuxconcept
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 7078 linuxconcept cwd unknown /proc/7078/cwd (readlink: Permission denied)
sshd 7078 linuxconcept rtd unknown /proc/7078/root (readlink: Permission denied)
bash 7081 linuxconcept cwd DIR 8,1 4096 12845058 /home/satish
bash 7081 linuxconcept txt REG 8,1 1037528 9175042 /bin/bash
bash 7081 linuxconcept 0u CHR 136,0 0t0 3 /dev/pts/0
systemd 14168 linuxconcept cwd DIR 8,1 4096 2 /
systemd 14168 linuxconcept txt REG 8,1 1577232 7864790 /lib/systemd/systemd
systemd 14168 linuxconcept mem REG 8,1 47600 7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
systemd 14168 linuxconcept 0r CHR 1,3 0t0 6 /dev/null
systemd 14168 linuxconcept 1u unix 0x0000000000000000 0t0 282381 type=STREAM
(sd-pam 14171 linuxconcept cwd unknown /proc/14171/cwd (readlink: Permission denied)
bash 14176 linuxconcept cwd DIR 8,1 4096 12845058 /home/satish
bash 14176 linuxconcept rtd DIR 8,1 4096 2 /
bash 14176 linuxconcept txt REG 8,1 1037528 9175042 /bin/bash
bash 14176 linuxconcept mem REG 8,1 35688 7864881 /lib/x86_64-linux-gnu/libnss_compat-2.23.so
bash 14176 linuxconcept 0u CHR 4,1 0t0 20 /dev/tty1
lsof 22325 linuxconcept cwd DIR 8,1 4096 12845058 /home/satish
lsof 22325 linuxconcept rtd DIR 8,1 4096 2 /Check all open files belongs to specific process
If you have the information of process like Process ID, you can directly check the opened file by that process using “-p” command line option as shown below.
$ lsof -p <PID>
$ lsof -p 1558Output:
linuxconcept@linuxconcept.com:/home/linuxconcept# lsof -p 1558
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ossec-age 1558 ossec cwd DIR 8,1 4096 8791672 /var/ossec
ossec-age 1558 ossec rtd DIR 8,1 4096 8791672 /var/ossec
ossec-age 1558 ossec mem REG 8,1 47600 7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
ossec-age 1558 ossec mem REG 8,1 162632 7864797 /lib/x86_64-linux-gnu/ld-2.23.so
ossec-age 1558 ossec 0u CHR 1,3 0t0 6 /dev/null
ossec-age 1558 ossec 3r REG 0,4 0 4026531991 /proc/uptime
ossec-age 1558 ossec 4r REG 0,4 0 4026531990 /proc/stat
ossec-age 1558 ossec 6u unix 0xffff880c22f69800 0t0 27895 /queue/ossec/queue type=DGRAM
ossec-age 1558 ossec 9u IPv4 34028 0t0 UDP 195-154-45-207.rev.poneytelecom.eu:34849->ip207.ip-5-196-165.eu:1514
ossec-age 1558 ossec 10u unix 0xffff880622a96000 0t0 34029 type=DGRAM
0 Comments