At times, we face situations where we cannot unmount a disk as it says that the files are being used, but we cannot understand which file it is referring to. In such situations, we can check which files are open by which process is running on the system.
This can be done using the lsof command, which means List Open Files. Since Linux considers everything, including directories, devices, sockets, and so on as files, we can use lsof to easily identify all open files.
If we just run lsof, it will list all of the open files that belong to any active process on the system. If the output is long, we can use the less command to scroll through the output:
# lsof | less
The output shown has columns such as Command, PID, User, FD, Type, Device, and so on, for a better understanding of the files. The FD column has information about the file’s description, such as the Current Working Directory (CWD), Root Directory (RTD), Program Text (TXT), and so on. If the FD column contains information like 0u, 1u, and so on, the number signifies the actual file descriptor and the alphabet signifies the different modes (read access, write access, and read/write access).
if you enconter the below error while running the lsof command:
lsof: command not found
ypu may install the below package as per your choice of distribution.
| Distribution | Command |
|---|---|
| OS X | brew install lsof |
| Debian | apt-get install lsof |
| Ubuntu | apt-get install lsof |
| Alpine | apk add lsof |
| Arch Linux | pacman -S lsof |
| Kali Linux | apt-get install lsof |
| CentOS | yum install lsof |
| Fedora | dnf install lsof |
| Raspbian | apt-get install lsof |
Frequently used lsof options
- -c x: Only show files that are open by processes whose executable starts with the character(s) specified by x.
- -i x: Instead of showing open files, show sockets whose Internet address is x. If x is not specified, show all IP connections. This is functionally equivalent to netstat –anp.
- -u username: Show only the files that username has open.
- -P: Do not convert port numbers to port names (for example, show 25 instead of smtp).
lsof Command Examples
Simply running the lsof commands gives us a list of all the open files on the system. By using the -u option and specifying the username, we get a list of open files for a particular user. When we use the -i option and specify a port number, we get information about any process running on that port. When we use both the -i and -u options with a particular username, we get information about the files and commands being accessed by that user.
1. Find the processes that have a given file open:
# lsof path/to/file
2. Find the process that opened a local internet port:
# lsof -i :port
3. Only output the process ID (PID):
# lsof -t path/to/file
4. List files opened by the given user:
# lsof -u username
5. List files opened by the given command or process:
# lsof -c process_or_command_name
6. List files opened by a specific process, given its PID:
# lsof -p PID
7. List open files in a directory:
# lsof +D path/to/directory
8. Find the process that is listening on a local IPv6 TCP port and don’t convert network or port numbers:
# lsof -i6TCP:port -sTCP:LISTEN -n -P
9. List processes that have your home directory opened:
# lsof ~
10. List all open files in your home directory:
# lsof +D
11. List the files opened by processes whose names begin with “i” and whose owner is “geek”:
# lsof -a -c i -u geek
12. List files using TCP port 80, repeating every two seconds until lsof is terminated:
Final Words
lsof lists open files. Since everything in Linux is a file, this tool can tell you a fantastic amount of information about your running system. It is primarily used to tell what processes have what files open, but it can also be used to view TCP and UDP connection information, among other things.