How to use lsof command in Linux?

In Linux lsof command is used to find which file is opened by which process. This command stands for List of Open Files. As we know in a Linux system everything is considered as a file this includes directories, devices, sockets, pipes, etc. So this command can be used to identify the files,  in cases such as when you try to unmount a device and it says a file is being used.

In this article, we will discuss the usage of the lsof command in Linux along with some examples.

How to use lsof command in Linux

The syntax of how to use the lsof command in Linux is given below.

lsof [options] [names]

Where you can find the list of detailed options on the man page of the lsof command. And the name is the name of a user, file, directory, etc.

Usage of Linux lsof command

The examples of using the lsof command on a Linux system are given below.

How to list all open files on a system

When you use the lsof command without any argument or options it displays the list of all files that are opened on a system.

sudo lsof

Running this command in privileged mode makes it display all the names or paths that require root permission.

Now see the output of this command in the given image.

The first column here shows the process name while the last column shows the file. Here you understand most of the data the FD stands file descriptor and may contain given values.

cwd – current working directory
rtd– root directory
txt – program text
mem– memory-mapped file

You will also find numbers like 0u followed by values r (read access), w (write access) or u (read & write access) in this column.

In the TYPE column, you will find the given values.
DIR – Represents a directory
REG – Regular file
CHR – Character special file
FIFO – First in first out

How to list all open files specific to a user

By using option -u with lsof command followed the user name will display the list of open files that belong to a specific user.

For example –

lsof -u lalit

This will display all the open files that belong to the user lalit. You can see the output in the given image.

You can see the user name in the USER column of this output.

How to list all files that are opened by a specific process

To display the list of all files that are opened by a particular process use option -c with lsof command on your system, use –

lsof -c chrome

This will display all the files that are opened by chrome.

How to list all network connections in a system

To display all the network connections in a system use the option -i with lsof command.

lsof -i

This will display all the connections that are listening and established.

How to find processes running on a specific port

You can use the given command to find the list of processes that are running on a particular port. If you want you can also learn how to check open ports on Linux.

lsof -i TCP:22

This will list all the processes running on port number 22.

How to list ipv4 and ipv6 open files

You can use the lsof command to display ipv4 and ipv6 open network files. Use the following command to display these files.

For ipv4 use –

lsof -i 4

For ipv6 use –

lsof -i 6

Here you will see the output as it is given in the image below.

How to display the list of all open files in a directory

You can use the lsof command to search for all open files or directories in a directory. You need to use the +D command-line option followed by the path to the directory with the lsof command.

For example –

lsof +D /usr/bin

This will display all the open files and directories of the bin directory in your terminal.

Similarly, you can explore other options that can be used with the lsof command in Linux. You can find the list of options on its man page.

man lsof

Conclusion

I hope you now understand the usage of the lsof command. Now if you have a query then write us in the comments below.

Leave a Comment