lsof Command in Linux with Examples

lsof command stands for “list open files” and it is incredibly useful for system administrators and developers alike. It provides information about files that are opened by processes. It is also helpful to identify resource leaks and understanding system behavior.

At its core, the lsof command lists information about open files. In this article, we will discuss the lsof command exploring its syntax, options, and practical use cases.

What is lsof Command

In Linux, everything is a file from regular files and directories to devices, sockets, and pipes. The lsof (List Open Files) command is a powerful utility that provides detailed information about files opened by processes. It’s particularly useful for identifying issues related to file usage, such as detecting files that are currently in use, finding files opened by specific users, and troubleshooting system performance issues.

Installation

The lsof command is pre-installed on most Linux distributions. If it’s not available on your system, you can install it using your package manager. Here’s how to install lsof on different distributions:

For Debian-based systems:

sudo apt-get install lsof

For Red Hat-based systems:

sudo yum install lsof

For Arch-based systems:

sudo pacman -S lsof

Basic Syntax

The basic syntax of the lsof command is:

lsof [options] [file ...]

Running lsof without any arguments will list all open files in the system. This can be overwhelming due to the abdrupt amount of information, so let’s explore some useful options and examples.

Example Usage

Following are the lsof command with example usage described below:

List All Open Files

To list all open files in the system, simply run the following:

lsof

This will display a long list of open files along with associated details such as the command, PID (Process ID), user, file descriptor, type, and file path.

List Open Files by Specific User

To list open files by a specific user, use the -u option followed by the username:

lsof -u username

For example, to list open files for the user root:

lsof -u root

List Open Files for Specific Processes

To list open files for a specific process, use the -p option followed by the process ID (PID):

lsof -p PID

For example, to list open files for the process with PID 1234:

lsof -p 1234

List Open Files in the Directory

To list all open files in a specific directory and its subdirectories, use the +D option followed by the directory path:

lsof +D /path/to/directory

For example, to list open files in /var/log:

lsof +D /var/log

List Network Connections

To list open network connections, use the -i option:

lsof -i

You can further filter network connections by protocol, port, or address. For example, to list TCP connections:

lsof -i tcp

To list connections on a specific port for example port 80:

lsof -i :80

List Files Opened by Specific Command

To list files opened by a specific command, use the -c option followed by the command name:

lsof -c command

For example, to list files opened by the sshd command:

lsof -c sshd

List Files Opened by Specific Device

To list files opened by a specific device, use the -d option followed by the device identifier:

lsof -d fd

For example, to list files opened by /dev/sda1:

lsof -d /dev/sda1

List Files in Use by Specific Network Address

To list files in use by a specific network address, use the -i option followed by the address:

lsof -i @address

For example, to list files in use by the IP address 192.168.1.100:

lsof -i @192.168.1.100

Kill Processes Holding a File

If you need to kill the processes holding a particular file, you can combine lsof with xargs and kill. For example, to kill all processes holding a file named myfile.txt:

lsof | grep myfile.txt | awk '{print $2}' | xargs kill -9

Advanced Usage

You can also list files opened by parent-child processes using the -R option:

lsof -R

To list files opened with a specific access mode (e.g., read or write), use the -a option in combination with the -r or -w options. For example, to list files opened for writing by a specific user:

lsof -a -u username -r

To monitor file access in real-time, you can use the -r option followed by the interval in seconds:

lsof -r 2

This command will refresh the list of open files every 2 seconds.

You can also list files opened by kernel threads, use the -K option:

lsof -K

To list open files along with their file descriptors, use the -F option:

lsof -F

Important Considerations

Following are some important considerations while using the lsof command in Linux:

• Ensure you have sufficient permissions to access the files and processes you want to inspect.
• For large systems, consider using less or more to paginate the output.
• Break down complex queries into simpler steps for better understanding.
• Use the -n option to avoid resolving network names and addresses.

Conclusion

The lsof command in Linux is a versatile tool that provides valuable insights into files opened by processes. By mastering the use of various options and examples provided in this guide, you can effectively monitor and manage system resources, troubleshoot issues, and ensure optimal performance.

FAQ