Linux lsof command tutorial for beginners (10 examples)

The lsof command in Linux displays in its output information about files that are opened by processes. In this article, we will discuss the tool using 10 easy to understand examples. Please note that all examples mentioned in this tutorial have been tested on Ubuntu 16.04LTS.

lsof

If you want to quickly see the name of files that have been opened by a particular process (or all processes), the lsof command lets you do that. An open file could be a regular file, directory, library, block special file, character special file, an executing text reference, or even a stream or a network file.

1. How to list all open files

To list all open files, run the lsof command without any arguments:

lsof

For example, Here is the screengrab of a part of the output the above command produced on my system:

How to list all open files on Linux

The first column represents the process while the last column contains file name. For details on all the columns, head to the command's man page.

2. How to list files opened by processes belonging to specific user

The tool also allows you to list files opened by processes belonging to a specific user. This feature can be accessed by using the -u command line option.

lsof -u [user-name]

For example:

lsof -u howtoforge

How to list files opened by processes belonging to specific user

3. How to list files based on their Internet address

The tool lets you to list files based on their Internet address. This can be done using the -i command line option. For example, if you want, you can have IPv4 and IPv6 files displayed separately. For IPv4, run the following command:

lsof -i 4 

For example:

How to list files based on their Internet address

Similarly, for IPv6, run the following command:

lsof -i 6 

For example:

lsof -i 6

Lsof output

4. How to list files specific to a process

The tool also lets you display opened files based on process identification (PID) numbers. This can be done by using the -p command line option. 

lsof -p [PID]

For example:

lsof -p 2066

How to list files specific to a process

Moving on, you can also exclude specific PIDs in output by adding the ^ symbol before them. To exclude a specific PID, you can run the following command:

lsof -p [^PID]

For example:

lsof -p ^1

How to list files specific to a process - result

As you can see in the above screenshot, the process with id 1 is excluded from the list.

5. How to list IDs of processes that have opened a particular file

The tool allows you to list IDs of processes that have opened a particular file. This can be done by using the -t command line option.

$ lsof -t [file-name]

For example:

$ lsof -t  /lib/i386-linux-gnu/libaudit.so.1.0.0

How to list IDs of processes that have opened a particular file

6. How to limit lsof to a particular directory

If you want, you can also make lsof search for all open instances of directory (including all the files and directories it contains). This feature can be accessed using the +D command line option.

$ lsof +D [directory-path]

For example:

$ lsof +D  /usr/lib/locale

How to limit lsof to a particular directory

7. How to list all Internet and x.25 (HP-UX) network files

This is possible by using the -i command line option we described earlier. Just that you have to use it without any arguments.

$ lsof -i

How to list all Internet and x.25 (HP-UX) network files

8. How to list open files based on port range

The utility also allows you to list open files based on a specific port or port range. For example, to display open files for port 1-1024, use the following command:

$ lsof -i :1-1024

How to list open files based on port range

9. How to list open files based on type of connection (TCP or UDP)

The tool allows you to list files based on the type of connection. For example, for UDP specific files, use the following command:

$ lsof -i udp

How to list open files based on type of connection (TCP or UDP)

Similarly, you can make lsof display TCP-specific files.

10. How to make lsof list Parent PID of processes

There's also an option that forces lsof to list the Parent Process IDentification (PPID) number in the output. The option in question is -R.

$ lsof -R

To get PPID info for a specific PID, you can run the following command:

$ lsof -p [PID] -R

For example:

$ lsof -p 3 -R

How to make lsof list Parent PID of processes

Conclusion

Although lsof offers a plethora of options, the ones we've discussed here should be enough to get you started. Once you're done practicing with these, head to the tool's man page to learn more about it. Oh, and in case you have any doubts and queries, drop in a comment below.

Share this page:

Suggested articles

0 Comment(s)

Add comment