Lesson 62: lsof Command

In this lesson, you'll learn how to use the lsof command to list open files and the processes using them in Linux.

lsof Command: A powerful tool for listing open files and the processes that are using them.

,lsof (meaning "LiSt Open Files") is used to find out which files are open by which Linux process.

As we all know, Linux/Unix considers everything as a file (pipes, sockets, directories, devices, etc.).

One of the reasons to use the lsof command is when a disk cannot be unmounted, as it says the files are being used.

With the help of the lsof command, we can easily identify the files that are in use.

Let's discuss some examples of lsof commands for understanding it.

lsof Command Syntax

# lsof [OPTIONS]

lsof Command Options

Option	Description
`-u USER`	List all open files of a specific user
`-i`	List all network connections (LISTENING & ESTABLISHED)
`-i TCP:PORT`	Find processes running on a specific port
`-i 4`	List only IPv4 open files
`-i 6`	List only IPv6 open files
`-i TCP:1-1024`	List open files of a TCP port range
`-u ^USER`	Exclude a specific user from the output
`-p PID`	List open files for a specific process ID
`-t`	Output only process IDs (useful in scripts)

1. List All Open Files

In the example below, it will show a long listing of open files. Some of them are extracted for better understanding, displaying columns like Command, PID, USER, FD, TYPE, etc.

# lsof

COMMAND    PID      USER   FD      TYPE     DEVICE  SIZE/OFF       NODE NAME
init         1      root  cwd      DIR      253,0      4096          2 /
init         1      root  rtd      DIR      253,0      4096          2 /
init         1      root  txt      REG      253,0    145180     147164 /sbin/init
init         1      root  mem      REG      253,0   1889704     190149 /lib/libc-2.12.so
init         1      root   0u      CHR        1,3       0t0       3764 /dev/null
init         1      root   1u      CHR        1,3       0t0       3764 /dev/null
init         1      root   2u      CHR        1,3       0t0       3764 /dev/null
init         1      root   3r     FIFO        0,8       0t0       8449 pipe
init         1      root   4w     FIFO       0,8       0t0       8449 pipe
init         1      root   5r      DIR       0,10         0          1 inotify
init         1      root   6r      DIR       0,10         0          1 inotify
init         1      root   7u     unix 0xc1513880       0t0       8450 socket

Sections and their values are self-explanatory. However, we'll review the FD and TYPE columns more precisely.

FD - stands for File Descriptor and may have some of the following values:

cwd - current working directory
rtd - root directory
txt - program text (code and data)
mem - memory-mapped file

Also in the FD column, numbers like 1u are the actual file descriptor followed by u, r, or w indicating its mode:

Module 1: File & Directory Management

Module 2: File Archiving & Compression

Module 3: Text Processing & Search

Module 4: Process Management

Module 5: Disk & Storage

Module 6: User & Permission Management

Module 7: System Information & Monitoring

Module 8: Package Management

Module 9: Networking

Module 10: Advanced & Security