Linux lsof command Help and Examples

April 18, 2019

Comments

Adsense

Adsense

Adsense

Adsense

Linux command lsof stands for list all open files.
The lsof command used to get the information of all open files by processes.

If you want to know which files are open by some specific process (or all processes), you can use the Linux command lsof; it will give all information in terms of open files by the processes.

An open file could be any types of file, regular file, directory, library file, character special file, block special file, or network or stream files.

Syntax of lsof command:
$ lsof <options>

Suggested Reading: Linux lsof command structure

Examples of lsof command:

Check all open files in system by process

To check all open files in system run “lsof” command without any option and arguments as shown below.

$ lsof

Output:

[email protected]:~# lsof
COMMAND     PID   TID             USER   FD      TYPE             DEVICE    SIZE/OFF       NODE NAME
systemd       1                   root  cwd       DIR                8,1        4096          2 /
systemd       1                   root  rtd       DIR                8,1        4096          2 /
systemd       1                   root  txt       REG                8,1     1577232    7864790 /lib/systemd/systemd
systemd       1                   root  mem       REG                8,1       18976    7864946 /lib/x86_64-linux-gnu/libuuid.so.1.3.0
systemd       1                   root  mem       REG                8,1      262408    7864939 /lib/x86_64-linux-gnu/libblkid.so.1.1.0
systemd       1                   root  mem       REG                8,1       14608    7864835 /lib/x86_64-linux-gnu/libdl-2.23.so
systemd       1                   root  mem       REG                8,1      461072    7869350 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
systemd       1                   root  mem       REG                8,1     1868984    7864821 /lib/x86_64-linux-gnu/libc-2.23.so
systemd       1                   root  mem       REG                8,1      138696    7864908 /lib/x86_64-linux-gnu/libpthread-2.23.so
systemd       1                   root  mem       REG                8,1      286824    7864435 /lib/x86_64-linux-gnu/libmount.so.1.1.0
systemd       1                   root  mem       REG                8,1       64144    7864433 /lib/x86_64-linux-gnu/libapparmor.so.1.4.0
systemd       1                   root  mem       REG                8,1       92864    7864859 /lib/x86_64-linux-gnu/libkmod.so.2.3.0
systemd       1                   root  mem       REG                8,1      117288    7864813 /lib/x86_64-linux-gnu/libaudit.so.1.0.0

Check all open files opened by process belongs to a user

The lsof tool allows us to check files information opened by the process which belongs to a specific user by using “-u” command line option as shown below.

$ lsof –u <username>
$ lsof -u linuxconcept

Output:

[email protected]:~$ lsof -u linuxconcept
COMMAND   PID   USER        FD      TYPE             DEVICE SIZE/OFF       NODE NAME
sshd     7078 linuxconcept  cwd   unknown                                        /proc/7078/cwd (readlink: Permission denied)
sshd     7078 linuxconcept  rtd   unknown                                        /proc/7078/root (readlink: Permission denied)
bash     7081 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
bash     7081 linuxconcept  txt       REG                8,1  1037528    9175042 /bin/bash
bash     7081 linuxconcept    0u      CHR              136,0      0t0          3 /dev/pts/0
systemd 14168 linuxconcept  cwd       DIR                8,1     4096          2 /
systemd 14168 linuxconcept  txt       REG                8,1  1577232    7864790 /lib/systemd/systemd
systemd 14168 linuxconcept  mem       REG                8,1    47600    7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
systemd 14168 linuxconcept    0r      CHR                1,3      0t0          6 /dev/null
systemd 14168 linuxconcept    1u     unix 0x0000000000000000      0t0     282381 type=STREAM
(sd-pam 14171 linuxconcept  cwd   unknown                                        /proc/14171/cwd (readlink: Permission denied)
bash    14176 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
bash    14176 linuxconcept  rtd       DIR                8,1     4096          2 /
bash    14176 linuxconcept  txt       REG                8,1  1037528    9175042 /bin/bash
bash    14176 linuxconcept  mem       REG                8,1    35688    7864881 /lib/x86_64-linux-gnu/libnss_compat-2.23.so
bash    14176 linuxconcept    0u      CHR                4,1      0t0         20 /dev/tty1
lsof    22325 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
lsof    22325 linuxconcept  rtd       DIR                8,1     4096          2 /

Check all open files belongs to specific process

If you have the information of process like Process ID, you can directly check the opened file by that process using “-p” command line option as shown below.

$ lsof  -p <PID>
$ lsof  -p 1558

Output:

[email protected]:/home/linuxconcept# lsof -p 1558
COMMAND    PID  USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAME
ossec-age 1558 ossec  cwd    DIR                8,1     4096    8791672 /var/ossec
ossec-age 1558 ossec  rtd    DIR                8,1     4096    8791672 /var/ossec
ossec-age 1558 ossec  mem    REG                8,1    47600    7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
ossec-age 1558 ossec  mem    REG                8,1   162632    7864797 /lib/x86_64-linux-gnu/ld-2.23.so
ossec-age 1558 ossec    0u   CHR                1,3      0t0          6 /dev/null
ossec-age 1558 ossec    3r   REG                0,4        0 4026531991 /proc/uptime
ossec-age 1558 ossec    4r   REG                0,4        0 4026531990 /proc/stat
ossec-age 1558 ossec    6u  unix 0xffff880c22f69800      0t0      27895 /queue/ossec/queue type=DGRAM
ossec-age 1558 ossec    9u  IPv4              34028      0t0        UDP 195-154-45-207.rev.poneytelecom.eu:34849->ip207.ip-5-196-165.eu:1514
ossec-age 1558 ossec   10u  unix 0xffff880622a96000      0t0      34029 type=DGRAM
Satish Kumar

Satish Kumar

I am Satish Kumar, Founder of LinuxConcept. Linux and F.O.S.S enthusiast, love to work on open source platform and technologies.

Adsense

Adsense

Adsense

Adsense

Adsense

Adsense

Adsense

Adsense

Adsense

Related Posts

The 30 most useful Linux commands

This article will introduce some practical and common Linux or Unix command , which is the Linux system administrators normally use the command . This article is not a complete list, but a brief list of commands that can be useful...

15 Practical examples of tcpdump command

15 Practical examples of tcpdump command

The tcpdump is the most essential and powerful command-line network packet sniffing tool. We use it to analyze network packets, capture or filter TCP/IP packets that transferred and received over the network on a specific network interface. It is available in almost...

15 Useful “df” Commands to Check Disk Space in Linux

15 Useful “df” Commands to Check Disk Space in Linux

There are several Linux tools available on the internet to check disk space utilization; we can use any of them. But, Linux has a best built-in command-line utility called “df”. The “df” is the short form of “disk filesystem”, we can get detailed information on used...

0 Comments

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

19 − four =

News & Updates

Join Our Newsletter

Adsense

Adsense

Adsense

Adsense