Linux command lsof stands for list all open files.
The lsof command used to get the information of all open files by processes.

If you want to know which files are open by some specific process (or all processes), you can use the Linux command lsof; it will give all information in terms of open files by the processes.

An open file could be any types of file, regular file, directory, library file, character special file, block special file, or network or stream files.

Syntax of lsof command:
$ lsof <options>

Suggested Reading: Linux lsof command structure

Examples of lsof command:

Check all open files in system by process

To check all open files in system run “lsof” command without any option and arguments as shown below.

$ lsof

Output:

[email protected]:~# lsof
COMMAND     PID   TID             USER   FD      TYPE             DEVICE    SIZE/OFF       NODE NAME
systemd       1                   root  cwd       DIR                8,1        4096          2 /
systemd       1                   root  rtd       DIR                8,1        4096          2 /
systemd       1                   root  txt       REG                8,1     1577232    7864790 /lib/systemd/systemd
systemd       1                   root  mem       REG                8,1       18976    7864946 /lib/x86_64-linux-gnu/libuuid.so.1.3.0
systemd       1                   root  mem       REG                8,1      262408    7864939 /lib/x86_64-linux-gnu/libblkid.so.1.1.0
systemd       1                   root  mem       REG                8,1       14608    7864835 /lib/x86_64-linux-gnu/libdl-2.23.so
systemd       1                   root  mem       REG                8,1      461072    7869350 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
systemd       1                   root  mem       REG                8,1     1868984    7864821 /lib/x86_64-linux-gnu/libc-2.23.so
systemd       1                   root  mem       REG                8,1      138696    7864908 /lib/x86_64-linux-gnu/libpthread-2.23.so
systemd       1                   root  mem       REG                8,1      286824    7864435 /lib/x86_64-linux-gnu/libmount.so.1.1.0
systemd       1                   root  mem       REG                8,1       64144    7864433 /lib/x86_64-linux-gnu/libapparmor.so.1.4.0
systemd       1                   root  mem       REG                8,1       92864    7864859 /lib/x86_64-linux-gnu/libkmod.so.2.3.0
systemd       1                   root  mem       REG                8,1      117288    7864813 /lib/x86_64-linux-gnu/libaudit.so.1.0.0

Check all open files opened by process belongs to a user

The lsof tool allows us to check files information opened by the process which belongs to a specific user by using “-u” command line option as shown below.

$ lsof –u <username>
$ lsof -u linuxconcept

Output:

[email protected]:~$ lsof -u linuxconcept
COMMAND   PID   USER        FD      TYPE             DEVICE SIZE/OFF       NODE NAME
sshd     7078 linuxconcept  cwd   unknown                                        /proc/7078/cwd (readlink: Permission denied)
sshd     7078 linuxconcept  rtd   unknown                                        /proc/7078/root (readlink: Permission denied)
bash     7081 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
bash     7081 linuxconcept  txt       REG                8,1  1037528    9175042 /bin/bash
bash     7081 linuxconcept    0u      CHR              136,0      0t0          3 /dev/pts/0
systemd 14168 linuxconcept  cwd       DIR                8,1     4096          2 /
systemd 14168 linuxconcept  txt       REG                8,1  1577232    7864790 /lib/systemd/systemd
systemd 14168 linuxconcept  mem       REG                8,1    47600    7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
systemd 14168 linuxconcept    0r      CHR                1,3      0t0          6 /dev/null
systemd 14168 linuxconcept    1u     unix 0x0000000000000000      0t0     282381 type=STREAM
(sd-pam 14171 linuxconcept  cwd   unknown                                        /proc/14171/cwd (readlink: Permission denied)
bash    14176 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
bash    14176 linuxconcept  rtd       DIR                8,1     4096          2 /
bash    14176 linuxconcept  txt       REG                8,1  1037528    9175042 /bin/bash
bash    14176 linuxconcept  mem       REG                8,1    35688    7864881 /lib/x86_64-linux-gnu/libnss_compat-2.23.so
bash    14176 linuxconcept    0u      CHR                4,1      0t0         20 /dev/tty1
lsof    22325 linuxconcept  cwd       DIR                8,1     4096   12845058 /home/satish
lsof    22325 linuxconcept  rtd       DIR                8,1     4096          2 /

Check all open files belongs to specific process

If you have the information of process like Process ID, you can directly check the opened file by that process using “-p” command line option as shown below.

$ lsof  -p <PID>

$ lsof  -p 1558

Output:

[email protected]:/home/linuxconcept# lsof -p 1558
COMMAND    PID  USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAME
ossec-age 1558 ossec  cwd    DIR                8,1     4096    8791672 /var/ossec
ossec-age 1558 ossec  rtd    DIR                8,1     4096    8791672 /var/ossec
ossec-age 1558 ossec  mem    REG                8,1    47600    7864885 /lib/x86_64-linux-gnu/libnss_files-2.23.so
ossec-age 1558 ossec  mem    REG                8,1   162632    7864797 /lib/x86_64-linux-gnu/ld-2.23.so
ossec-age 1558 ossec    0u   CHR                1,3      0t0          6 /dev/null
ossec-age 1558 ossec    3r   REG                0,4        0 4026531991 /proc/uptime
ossec-age 1558 ossec    4r   REG                0,4        0 4026531990 /proc/stat
ossec-age 1558 ossec    6u  unix 0xffff880c22f69800      0t0      27895 /queue/ossec/queue type=DGRAM
ossec-age 1558 ossec    9u  IPv4              34028      0t0        UDP 195-154-45-207.rev.poneytelecom.eu:34849->ip207.ip-5-196-165.eu:1514
ossec-age 1558 ossec   10u  unix 0xffff880622a96000      0t0      34029 type=DGRAM

If You Like What We Do Here On LinuxConcept, You Should Consider:

Stay Connected to: Twitter | Facebook

Subscribe to our email updates: Sign Up Now

 

We are thankful for your support.

Follow me