How to use lsof command in Linux

The job of lsof command is to “list open files” in the system. An open file does not necessarily mean a pdf or a text file, it includes disk files or pipes used by processes in the background.

This command is a handy tool for Operating System debuggers and system administrators.

Even though the lsof command is a preinstalled Linux utility, Ubuntu/Debian users can install using apt if you don’t have it installed:

sudo apt install lsof

Other Linux users can install via their standard installation command followed by lsof.

Let us quickly move on to the usage of lsof command:

List all open files in the system

By running the lsof command without any options, we can list all the open files in the system. Doing so will flush the terminal with loads of data. Therefore, it is advisable to use less command which limits the data thrown by any command

sudo lsof | less

By pressing the 'ENTER' or the down arrow key, we can navigate to the bottom of the list.

Each file in the output provides important information about its type and usage.

• COMMAND – The Linux command associated with the process responsible for opening the file.
• PID – Process ID of the process holding the file.
• TID – The thread ID for the respective process.
• USER – The Linux User managing the process.
• FD – File descriptor used by the process to associate with the file.
  • cwd – current working directory
  • rtd – root directory
  • txt – a textual program like some code
  • mem – memory-mapped file
• TYPE – The type of the file
  • REG – Regular file
  • DIR – Directory
  • CHR – Character file
  • LINK – Symbolic link file
• DEVICE – The device numbers related to the file.
• SIZE/OFF – The size of the file or its offset in bytes.
• NODE – The inode number.
• NAME – The name of the file.

Note: Some information like inode or device number might be redacted if the command is not run using root permissions.

We can learn more about the output from the manual pages that can be accessed from the terminal by running man lsof.

List all open files by a specific user using the lsof command

The lsof command supports many options that can be applied to filter the opened files. One of these is -u option to display open files for a specific user.

sudo lsof -u <USER_NAME> | less

The third column is based on the user responsible for the opening of the file. Similar to the basic output, the terminal is over-crowded with meaningless data and therefore use of less command is advised.

List open files in a particular directory

Files exist within a directory, therefore it is quite trivial that we can extract open files in a particular directory.

lsof +D <DIR_NAME>

In the above figure, we listed the file currently open in the Documents folder. The opened file is a regular C++ file.

List open files in a particular file-system with the lsof command

Instead of a single directory, lsof command can list open files from a particular file-system. This is achieved by placing the name of the file-system after the lsof command.

lsof <FILE_SYSTEM>

In the above figure, we display the opened files in the /proc file-system.

List open files by a particular process

Using the process IDs, we can filter the opened files. This can be done with the help of -p option.

lsof -p <PID>

The above snippet of the terminal shows the list of open files for the process with PID as 3404.

Note: The caret symbol (^) is used to negate the parameters in the lsof command. For instance lsof -p ^3404, displays the list of open files for all PIDs except 3404.

List open network files

Linux stores a range of network files for storing IP addresses or network interface configuration. These kinds of open files can be filtered out by -i flag.

lsof -i 

These files have certain characteristics like the types of Networking Protocols. The open files can further be filtered using specific parameters like:

• ‘4’ – The network files for IPv4
• ‘6’ – The network files for IPv6
• ‘TCP’ – The network files for TCP
• ‘UDP’ – The network files for UDP
• ‘TCP:25’ – The network files for TCP, with port number 25
• ‘TCP:1-25’ – The network files for TCP, with port number from 1 to 25

For instance:

lsof -i 6

Using lsof Command to Search open files on the basis of command

With thousands of open files in the system, it seems impossible to linearly search for a particular command. Therefore, the lsof command has the -c option to filter out open files on the basis of command.

lsof -c <COMMAND>

Conclusion

The lsof command supports plenty of options that are effective in debugging and troubleshooting system problems. Interested readers can visit the manual pages through the terminal by running man lsof, to gain more knowledge about the privileges and output of the command.

Feel free to comment below for any queries or feedback.