Skip to content
Search

Lsof

lastmod 2026-02-04created 2014-01-1213 edits

On a linux system, files can be opened through processes. Here, "file" includes not only files that hold data, but also file descriptors such as sockets for communication and event_poll, library files, and even char devices. A way to check files is needed, for example to debug whether a socket is actually open when a developed program communicates over sockets, and for system monitoring, to check how many files are open, since the number of files a process can open is limited. To get to the point: with the command lsof (list open file), you can check the files opened by all processes.

How to install 

$ sudo yum install lsof

Examples

sudo lsof -i -P -n
The command I use most often. Prints open network port numbers and processes
lsof -i TCP:22
Specify a particular port number
lsof -i
Show both TCP/UDP
lsof -i TCP
Show TCP only
lsof -i UDP
Show UDP only
lsof -i 4
Check IPv4 only
lsof -i 6
Check IPv6 only
lsof -i TCP -P | grep java | grep LISTEN
With the -P option, port numbers are shown instead of service names.
lsof -c httpd
Print the ports used by a specific command with the -c option.
In the case of apache httpd, it forks and multiple processes come up.
Giving the -c option and httpd prints information about the files opened by httpd.
lsof +D /tmp
Shows open files under the /tmp directory.
Sometimes you want to show open files under a specific directory. In that case, specify the directory path after the +D option.
lsof /var/log/httpd/access_log
You can see detailed information about the processes using a specific file.
Just specify the file path without options.
lsof -u $USER
You can specify a user with the -u option.
lsof -t -u $USER
The -t option prints only pid information instead of detailed information.
Mainly used together with the kill command.
lsof -p 123
Shows only the files opened by a specific process.
Just give the PID after the -p option.

Meaning of each column

  • COMMAND : the command that was run
  • PID : process id
  • USER : the user who ran it
  • FD: File Descriptor, the kind of file.
    • cwd: current working directory
    • rtd: root directory
    • mem : memory-mapped file
    • txt: program text (code and data);
  • TYPE: file type
    • DIR: directory
    • CHR: character special file
    • REG: regular file
    • unix: Unix domain socket (a socket used by MySQL and others; usable only by local processes and much faster than TCP/UDP)
  • DEVICE : device number
  • SIZE/OFF: file size or offset
  • NODE: node number
  • NAME: file name 

$ lsof


COMMAND    PID      USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
init         1      root  cwd       DIR              253,0     4096          2 /
init         1      root  rtd       DIR              253,0     4096          2 /
init         1      root  txt       REG              253,0   150352       3932 /sbin/init
init         1      root  mem       REG              253,0    65928     784927 /lib64/libnss_files-2.12.so
init         1      root  DEL       REG              253,0              784911 /lib64/libc-2.12.so
init         1      root  DEL       REG              253,0              785325 /lib64/libgcc_s-4.4.7-20120601.so.1.#prelink#.YDRQV5
init         1      root  DEL       REG              253,0              784939 /lib64/librt-2.12.so
init         1      root  DEL       REG              253,0              784935 /lib64/libpthread-2.12.so.#prelink#.0jHMuJ
init         1      root  DEL       REG              253,0              785344 /lib64/libdbus-1.so.3.4.0.#prelink#.HCYJdq
init         1      root  mem       REG              253,0    39896     785047 /lib64/libnih-dbus.so.1.0.0
init         1      root  mem       REG              253,0   101920     785049 /lib64/libnih.so.1.0.0
init         1      root  DEL       REG              253,0              784904 /lib64/ld-2.12.so
init         1      root    0u      CHR                1,3      0t0       4160 /dev/null
init         1      root    1u      CHR                1,3      0t0       4160 /dev/null
init         1      root    2u      CHR                1,3      0t0       4160 /dev/null
init         1      root    3r     FIFO                0,8      0t0       8845 pipe
init         1      root    4w     FIFO                0,8      0t0       8845 pipe
init         1      root    5r      DIR               0,10        0          1 inotify
init         1      root    6r      DIR               0,10        0          1 inotify
init         1      root    7u     unix 0xffff880037504680      0t0       8846 socket

See also

  • Handle (Process Utility)
  • netstate
  • kill
  • ps
  • Sloth - Mac app that shows all open files/directories/sockets, etc.
  • strace
  • fuser - Find processes using a specific file/port
  • inotifywait - Watch specific files/directories
  • bpftrace/bcc - Minimal overhead, suitable for production environments
  • auditd - System-level audit logs (can be configured persistently)

Favorite site

author Zer0 sitemap