How to Use the lsof Command to List Open Files

The lsof (List Open Files) command is a powerful utility used in Unix and Linux systems for displaying information about open files. Since everything in Unix is treated as a file, lsof provides insight into processes and resources currently being accessed on the system.

Why Use lsof?

The lsof command is commonly used for:

• Identify Open Files: List files currently open by running processes.
• Monitor Network Connections: View network-related activities and determine which ports are being used.
• Diagnose System Issues: Identify processes that may be causing system slowdowns.
• Troubleshoot File Locking: Determine which processes have locked a file, preventing access or modifications.
• Security Auditing: Check for unauthorized file access or abnormal process activity.

Basic Syntax

The basic syntax of the lsof command is:

lsof [options] [file | directory | device]

Installing lsof

On most Linux distributions, lsof comes pre-installed. If it is not available, you can install it using the package manager:

Ubuntu/Debian:

sudo apt update
sudo apt install lsof

Red Hat/CentOS:

sudo yum install lsof

MacOS:

brew install lsof

Common Usage Examples

1. List All Open Files

To list all open files on the system:

lsof

This will display a detailed list including file descriptors, file paths, and the associated processes.

2. List Files Opened by a Specific User

To list all open files belonging to a specific user:

lsof -u username

3. List Files Opened by a Specific Process

To view all open files for a process identified by PID:

lsof -p 1234

4. List Open Network Connections

To list all open network connections:

lsof -i

5. Find a Process Using a Specific Port

To identify which process is using a specific port (e.g., port 80):

lsof -i :80

6. Check Files Open in a Specific Directory

To list all files open in a specific directory:

lsof +D /path/to/directory

Output Explained

The output of the lsof command includes multiple columns such as:

• COMMAND: Name of the command associated with the process.
• PID: Process ID.
• USER: User who owns the process.
• FD: File descriptor (e.g., cwd, txt, mem).
• TYPE: Type of file (e.g., REG for regular file, DIR for directory).
• DEVICE: Device numbers.
• SIZE/OFF: File size or offset.
• NODE: Node number (filesystem-specific identifier).
• NAME: Name of the file or network connection.

Filtering Results

The lsof command supports various options for filtering results:

• -t: Display process IDs only.
• -r: Repeat listing every second.
• -c [command]: Filter results by command name.
• -n: Prevent converting IP addresses to hostnames.
• -P: Prevent converting port numbers to service names.

Using lsof for Network Monitoring

List Active TCP Connections

lsof -i tcp

List Active UDP Connections

lsof -i udp

Check Listening Ports

lsof -i | grep LISTEN

Identifying Locked Files

If a file is locked by a process and you need to identify the culprit:

lsof /path/to/lockedfile

Killing Processes Using lsof

To identify and terminate a process using a file:

lsof /path/to/file
kill -9 <PID>

Troubleshooting with lsof

High CPU Usage Diagnosis

lsof -p <PID> | grep -E 'txt|mem'

This helps identify which files a process is using that may be causing excessive resource use.

File Descriptor Limits

Check the number of open file descriptors for a process:

lsof -p <PID> | wc -l

Security Auditing with lsof

You can also use lsof for basic security audits, such as identifying all open files by root:

lsof -u root

Best Practices

• Use sudo for Comprehensive Results: Many files are only visible to privileged users.
• Combine with Other Commands: Use lsof alongside grep and awk for more specific results.
• Be Cautious with kill -9: Forcefully killing processes can result in data loss.

Conclusion

The lsof command is an indispensable tool for system administrators and developers for monitoring open files, managing network connections, and diagnosing resource issues effectively. Familiarize yourself with its options and best practices to gain better control over your system and ensure smooth operation.