How to Use the ‘lsof’ Command in Linux

Learn how to monitor and manage open files in Linux with the lsof command

By . in Desktop. Updated on .

The lsof command, standing for “List Open Files,” is a powerful tool in the Linux operating system that provides essential information about files that are opened by various processes. This versatile command allows system admins to monitor and manage files, sockets, and network connections, offering a comprehensive view of how resources are being utilized within the system.

Similar to commands like netstat and fuser, the lsof command is used to identify the files that are being accessed by different processes, making it an indispensable tool for troubleshooting and system maintenance. Whether you’re a network administrator seeking to resolve conflicts or a developer looking to optimize resource allocation, the lsof command, often used alongside commands like grep, can be a handy addition to your toolkit.

How to Install the lsof Command

In many Linux distributions, the lsof command comes pre-installed. However, if it’s not available on your system, you can easily install it using the package manager specific to your distribution.

Debian-based Systems (e.g., Ubuntu)

Install:

sudo apt-get update
sudo apt-get install lsof

Uninstall:

sudo apt-get remove lsof

Red Hat-based Systems (e.g., CentOS, RHEL)

Install using Yum (older versions):

sudo yum install lsof

Install using DNF (newer versions):

sudo dnf install lsof

Uninstall using Yum:

sudo yum remove lsof

Uninstall using DNF:

sudo dnf remove lsof

Fedora

Install (older versions using Yum):

sudo yum install lsof

Install (newer versions using DNF):

sudo dnf install lsof

Uninstall using Yum:

sudo yum remove lsof

Uninstall using DNF:

sudo dnf remove lsof

How to Use lsof

1. List All Open Files

Syntax: lsof

Explanation: Lists all open files on the system.

Example: lsof

Output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
systemd    1 root  cwd    DIR  253,1     4096      2 /
bash    1234 user  txt    REG  253,1   111350 123456 /bin/bash

This output shows all the open files, including the command name, process ID (PID), user, file descriptor (FD), type, device, size, and the file’s path.

2. List Files Opened by a Specific User

Syntax: lsof -u <username>

Explanation: Lists all files opened by a specific user.

Example: lsof -u john

Output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
bash    5678 john  cwd    DIR  253,1     4096  78901 /home/john

This output lists all the files opened by the user john, including the command name, PID, user, and other details.

3. List Files Used by a Specific Process

Syntax: lsof -p <PID>

Explanation: Lists all files used by a specific process ID.

Example: lsof -p 1234

Output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
bash    1234 user  cwd    DIR  253,1     4096  78901 /home/user

This output lists all the files used by the process with PID 1234, including the command name, PID, user, and other details.

4. List Files on a Specific Port

Syntax: lsof -i :<port>

Explanation: Lists all files associated with a specific network port.

Example: lsof -i :80

Output:

COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
apache  1234 www-data  4u  IPv4  12345      0t0  TCP *:http (LISTEN)

This output lists all the files associated with port 80, typically used for HTTP. It includes the command name, PID, user, and other details related to the network connection.

5. List Files Opened by a Specific Command

Syntax: lsof -c <command_name>

Explanation: Lists all files opened by a specific command.

Example: lsof -c sshd

Output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
sshd    1234 root  cwd    DIR  253,1     4096      2 /

This output lists all the files opened by the sshd command, including the command name, PID, user, and other details.

6. List Files Opened on a Specific File System

Syntax: lsof +D <directory>

Explanation: Lists all files opened within a specific directory or file system.

Example: lsof +D /var

Output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
syslog  567 root    5w   REG  253,2     4096  12345 /var/log/syslog

This output lists all the files opened within the /var directory, including the command name, PID, user, and other details.

7. List Network Files of a Specific Protocol

Syntax: lsof -i <protocol>

Explanation: Lists all network files using a specific protocol (e.g., TCP or UDP).

Example: lsof -i TCP

Output:

COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1234 root    3u  IPv4  56789      0t0  TCP *:ssh (LISTEN)

This output lists all the TCP network connections, including the command name, PID, user, and other details related to the network connection.

8. List Files Excluding Those Opened by a Specific User

Syntax: lsof -u ^<username>

Explanation: Lists all files excluding those opened by a specific user.

Example: lsof -u ^john

Output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
systemd    1 root  cwd    DIR  253,1     4096      2 /

This output lists all the files excluding those opened by the user john, including the command name, PID, user, and other details.

More Linux commands:
Directory Operations rmdir · cd · pwd · exa · ls
File Operations cat · cp · dd · less · touch · ln · rename · more · head
File System Operations chown · mkfs · locate
Networking ping · curl · wget · iptables · mtr
Search and Text Processing find · grep · sed · whatis · ripgrep · fd · tldr
System Information and Management env · history · top · who · htop · glances · lsof
User and Session Management screen · su · sudo · open
WebsiteFacebookTwitterInstagramPinterestLinkedInGoogle+YoutubeRedditDribbbleBehanceGithubCodePenWhatsappEmail