lsof Command in Linux with Examples

lsof command stands for “list open files” and it is incredibly useful for system administrators and developers alike. It provides information about files that are opened by processes. It is also helpful to identify resource leaks and understanding system behavior.

At its core, the lsof command lists information about open files. In this article, we will discuss the lsof command exploring its syntax, options, and practical use cases.

What is lsof Command

In Linux, everything is a file from regular files and directories to devices, sockets, and pipes. The lsof (List Open Files) command is a powerful utility that provides detailed information about files opened by processes. It’s particularly useful for identifying issues related to file usage, such as detecting files that are currently in use, finding files opened by specific users, and troubleshooting system performance issues.

Installation

The lsof command is pre-installed on most Linux distributions. If it’s not available on your system, you can install it using your package manager. Here’s how to install lsof on different distributions:

For Debian-based systems:

sudo apt-get install lsof

For Red Hat-based systems:

sudo yum install lsof

For Arch-based systems:

sudo pacman -S lsof

Basic Syntax

The basic syntax of the lsof command is:

lsof [options] [file ...]

Running lsof without any arguments will list all open files in the system. This can be overwhelming due to the abdrupt amount of information, so let’s explore some useful options and examples.

Example Usage

Following are the lsof command with example usage described below:

List All Open Files

To list all open files in the system, simply run the following:

lsof
lsof

This will display a long list of open files along with associated details such as the command, PID (Process ID), user, file descriptor, type, and file path.

List Open Files by Specific User

To list open files by a specific user, use the -u option followed by the username:

lsof -u username

For example, to list open files for the user root:

lsof -u root
lsof username

List Open Files for Specific Processes

To list open files for a specific process, use the -p option followed by the process ID (PID):

lsof -p PID

For example, to list open files for the process with PID 1234:

lsof -p 1234

List Open Files in the Directory

To list all open files in a specific directory and its subdirectories, use the +D option followed by the directory path:

lsof +D /path/to/directory

For example, to list open files in /var/log:

lsof +D /var/log
lsof directory

List Network Connections

To list open network connections, use the -i option:

lsof -i

You can further filter network connections by protocol, port, or address. For example, to list TCP connections:

lsof -i tcp
lsof tcp

To list connections on a specific port for example port 80:

lsof -i :80

List Files Opened by Specific Command

To list files opened by a specific command, use the -c option followed by the command name:

lsof -c command

For example, to list files opened by the sshd command:

lsof -c sshd
lsof sshd

List Files Opened by Specific Device

To list files opened by a specific device, use the -d option followed by the device identifier:

lsof -d fd

For example, to list files opened by /dev/sda1:

lsof -d /dev/sda1

List Files in Use by Specific Network Address

To list files in use by a specific network address, use the -i option followed by the address:

lsof -i @address

For example, to list files in use by the IP address 192.168.1.100:

lsof -i @192.168.1.100

Kill Processes Holding a File

If you need to kill the processes holding a particular file, you can combine lsof with xargs and kill. For example, to kill all processes holding a file named myfile.txt:

lsof | grep myfile.txt | awk '{print $2}' | xargs kill -9

Advanced Usage

You can also list files opened by parent-child processes using the -R option:

lsof -R

To list files opened with a specific access mode (e.g., read or write), use the -a option in combination with the -r or -w options. For example, to list files opened for writing by a specific user:

lsof -a -u username -r

To monitor file access in real-time, you can use the -r option followed by the interval in seconds:

lsof -r 2

This command will refresh the list of open files every 2 seconds.

You can also list files opened by kernel threads, use the -K option:

lsof -K

To list open files along with their file descriptors, use the -F option:

lsof -F

Important Considerations

Following are some important considerations while using the lsof command in Linux:

  • Ensure you have sufficient permissions to access the files and processes you want to inspect.
  • For large systems, consider using less or more to paginate the output.
  • Break down complex queries into simpler steps for better understanding.
  • Use the -n option to avoid resolving network names and addresses.

Conclusion

The lsof command in Linux is a versatile tool that provides valuable insights into files opened by processes. By mastering the use of various options and examples provided in this guide, you can effectively monitor and manage system resources, troubleshoot issues, and ensure optimal performance.

At Ultahost, we are committed to providing our customers with the best possible service and support, and we are always working to improve our offerings. Our dedicated hosting is designed to be scalable and flexible so you can always choose the right amount of resources for your needs.

FAQ

What is the lsof command in Linux?
How do I install lsof on Linux?
How can I see which files a process has opened?
Can I check network connections with lsof?
How do I find who’s using a specific file?
Can lsof help free up a locked file?
How do I list open files by a specific user?

Related Post

How to Create a Linux Swap File

A swap file is a designated space on a hard disk drive ...

How to Find a File with Find Command in Linux

The find command in Linux is a powerful and versatile t...

How to Install SSL on Linux VPS Using Certbot

Securing your website with SSL stands for Secure Socket...

Exploring Linux ip Command with Examples

The Linux IP command is a powerful tool used for managi...

How to Use the Rsync Command in Linux

Rsync, which stands for "remote sync," is a powerful an...

Guide to Installing Commands on CentOS

When a Windows user switches to Linux the first thing i...

Leave a Comment