6/14/2017 15 Linux lsof Command Examples (Identify Open Files)

Menu

Home
FreeeBook
StartHere
Contact
About

15LinuxlsofCommandExamples(IdentifyOpen
Files)
byLakshmananGanapathyonAugust29,2012
62 Like 72 Tweet

lsofstandsforListOpenFiles.

Itiseasytorememberlsofcommandifyouthinkofitasls+of,wherelsstandsforlist,andofstandsfor
openfiles.

Itisacommandlineutilitywhichisusedtolisttheinformationaboutthefilesthatareopenedbyvarious
processes.Inunix,everythingisafile,(pipes,sockets,directories,devices,etc.).Sobyusinglsof,youcanget
theinformationaboutanyopenedfiles.

1.Introductiontolsof
Simplytypinglsofwillprovidealistofallopenfilesbelongingtoallactiveprocesses.

#lsof

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
init1rootcwdDIR8,140962/
init1roottxtREG8,1124704917562/sbin/init
init1root0uCHR1,30t04369/dev/null
init1root1uCHR1,30t04369/dev/null
init1root2uCHR1,30t04369/dev/null
init1root3rFIFO0,80t06323pipe
...

http://www.thegeekstuff.com/2012/08/lsof-command-examples 1/13
6/14/2017 15 Linux lsof Command Examples (Identify Open Files)

BydefaultOnefileperlineisdisplayed.Mostofthecolumnsareselfexplanatory.Wewillexplainthedetails
aboutcoupleofcrypticcolumns(FDandTYPE).

FDRepresentsthefiledescriptor.SomeofthevaluesofFDsare,

cwdCurrentWorkingDirectory
txtTextfile
memMemorymappedfile
mmapMemorymappeddevice
NUMBERRepresenttheactualfiledescriptor.Thecharacterafterthenumberi.e1u,representsthe
modeinwhichthefileisopened.rforread,wforwrite,uforreadandwrite.

TYPESpecifiesthetypeofthefile.SomeofthevaluesofTYPEsare,

REGRegularFile
DIRDirectory
FIFOFirstInFirstOut
CHRCharacterspecialfile

ForacompletelistofFD&TYPE,refermanlsof.

2.Listprocesseswhichopenedaspecificfile
Youcanlistonlytheprocesseswhichopenedaspecificfile,byprovidingthefilenameasarguments.

#lsof/var/log/syslog

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
rsyslogd488syslog1wREG8,11151268940/var/log/syslog

3.Listopenedfilesunderadirectory

Youcanlisttheprocesseswhichopenedfilesunderaspecifieddirectoryusing+Doption.+Dwillrecursethe
subdirectoriesalso.Ifyoudontwantlsoftorecurse,thenuse+doption.

#lsof+D/var/log/

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
rsyslogd488syslog1wREG8,11151268940/var/log/syslog
rsyslogd488syslog2wREG8,12405269616/var/log/auth.log
consolek144root9wREG8,110871269369/var/log/ConsoleKit/history
http://www.thegeekstuff.com/2012/08/lsof-command-examples 2/13
6/14/2017 15 Linux lsof Command Examples (Identify Open Files)

4.Listopenedfilesbasedonprocessnamesstartingwith

Youcanlistthefilesopenedbyprocessnamesstartingwithastring,usingcoption.cfollowedbythe
processnamewilllistthefilesopenedbytheprocessstartingwiththatprocessesname.Youcangivemultiplec
switchonasinglecommandline.

#lsofcsshcinit

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
init1roottxtREG8,1124704917562/sbin/init
init1rootmemREG8,114341801442625/lib/i386linuxgnu/libc2.13.so
init1rootmemREG8,1306841442694/lib/i386linuxgnu/librt2.13.so
...
sshagent1528lakshmanan1uCHR1,30t04369/dev/null
sshagent1528lakshmanan2uCHR1,30t04369/dev/null
sshagent1528lakshmanan3uunix0xdf70e2400t010464/tmp/sshsUymKXxw1495/agent.1495

5.Listprocessesusingamountpoint

Sometimewhenwetrytoumountadirectory,thesystemwillsayDeviceorResourceBusyerror.Soweneed
tofindoutwhatarealltheprocessesusingthemountpointandkillthoseprocessestoumountthedirectory.By
usinglsofwecanfindthoseprocesses.

#lsof/home

Thefollowingwillalsowork.

#lsof+D/home/

6.Listfilesopenedbyaspecificuser

Inordertofindthelistoffilesopenedbyaspecificusers,useuoption.

#lsofulakshmanan

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
updateno1892lakshmanan20rFIFO0,80t014536pipe
updateno1892lakshmanan21wFIFO0,80t014536pipe
bash1995lakshmanancwdDIR8,14096393218/home/lakshmanan

Sometimesyoumaywanttolistfilesopenedbyallusers,expectsome1or2.Inthatcaseyoucanusethe^to
excludeonlytheparticularuserasfollows

#lsofu^lakshmanan

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
rtkitdae1380rtkit7u00000,904360anon_inode
udisksda1584rootcwdDIR8,140962/

Theabovecommandlistedallthefilesopenedbyallusers,expectuserlakshmanan.

7.Listallopenfilesbyaspecificprocess

Youcanlistallthefilesopenedbyaspecificprocessusingpoption.Itwillbehelpfulsometimestogetmore
informationaboutaspecificprocess.

#lsofp1753

http://www.thegeekstuff.com/2012/08/lsof-command-examples 3/13
6/14/2017 15 Linux lsof Command Examples (Identify Open Files)
COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
bash1753lakshmanancwdDIR8,14096393571/home/lakshmanan/test.txt
bash1753lakshmananrtdDIR8,140962/
bash1753lakshmanan255uCHR136,00t03/dev/pts/0
...

8.Killallprocessthatbelongstoaparticularuser
Whenyouwanttokillalltheprocesseswhichhasfilesopenedbyaspecificuser,youcanusetoptiontolist
outputonlytheprocessidoftheprocess,andpassittokillasfollows
#kill9`lsoftulakshmanan`

Theabovecommandwillkillallprocessbelongingtouserlakshmanan,whichhasfilesopened.

Similarlyyoucanalsousetinmanyways.Forexample,tolistprocessidofaprocesswhichopened
/var/log/syslogcanbedoneby
#lsoft/var/log/syslog

489

Talkingaboutkill,didyouknowthatthereare4WaystoKillaProcess?

9.CombinemorelistoptionsusingOR/AND

Bydefaultwhenyouusemorethanonelistoptioninlsof,theywillbeORed.Forexample,
#lsofulakshmanancinit

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
init1rootcwdDIR8,140962/
init1roottxtREG8,1124704917562/sbin/init
bash1995lakshmanan2uCHR136,20t05/dev/pts/2
bash1995lakshmanan255uCHR136,20t05/dev/pts/2
...

Theabovecommandusestwolistoptions,uandc.Sothecommandwilllistprocessbelongstouser
lakshmananaswellasprocessnamestartswithinit.

Butwhenyouwanttolistaprocessbelongstouserlakshmananandtheprocessnamestartswithinit,you
canuseaoption.

#lsofulakshmanancinita

Theabovecommandwillnotoutputanything,becausethereisnosuchprocessnamedinitbelongingtouser
lakshmanan.

10.Executelsofinrepeatmode
lsofalsosupportRepeatmode.Itwillfirstlistfilesbasedonthegivenparameters,anddelayforspecified
secondsandagainlistfilesbasedonthegivenparameters.Itcanbeinterruptedbyasignal.

Repeatmodecanbeenabledbyusingror+r.If+risusedthen,therepeatmodewillendwhennoopen
filesarefound.rwillcontinuetolist,delay,listuntilainterruptisgivenirrespectiveoffilesareopenedornot.

Eachcycleoutputwillbeseparatedbyusing=======.Youalsoalsospecifythetimedelayasr|+r.
http://www.thegeekstuff.com/2012/08/lsof-command-examples 4/13
6/14/2017 15 Linux lsof Command Examples (Identify Open Files)
#lsofulakshmanancinitar5

=======
=======
COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
inita.sh2971lakshmanancwdDIR8,14096393218/home/lakshmanan
inita.sh2971lakshmananrtdDIR8,140962/
inita.sh2971lakshmanantxtREG8,183848524315/bin/dash
inita.sh2971lakshmananmemREG8,114341801442625/lib/i386linuxgnu/libc2.13.so
inita.sh2971lakshmananmemREG8,11179601442612/lib/i386linuxgnu/ld2.13.so
inita.sh2971lakshmanan0uCHR136,40t07/dev/pts/4
inita.sh2971lakshmanan1uCHR136,40t07/dev/pts/4
inita.sh2971lakshmanan2uCHR136,40t07/dev/pts/4
inita.sh2971lakshmanan10rREG8,120393578/home/lakshmanan/inita.sh
=======

Intheaboveoutput,forthefirst5seconds,thereisnooutput.Afterthatascriptnamedinita.shisstarted,and
itlisttheoutput.

FindingNetworkConnection
Networkconnectionsarealsofiles.Sowecanfindinformationaboutthembyusinglsof.

11.Listallnetworkconnections
Youcanlistallthenetworkconnectionsopenedbyusingioption.
#lsofi

COMMANDPIDUSERFDTYPEDEVICESIZE/OFFNODENAME
avahidae515avahi13uIPv468480t0UDP*:mdns
avahidae515avahi16uIPv668510t0UDP*:52060
cupsd1075root5uIPv6225120t0TCPip6localhost:ipp(LISTEN)

Youcanalsousei4ori6tolistonlyIPV4orIPV6respectively.

12.Listallnetworkfilesinusebyaspecificprocess

Youcanlistallthenetworkfileswhichisbeingusedbyaprocessasfollows

#lsofiap234

Youcanalsousethefollowing
#lsofiacssh

Theabovecommandwilllistthenetworkfilesopenedbytheprocessesstartingwithssh.

13.Listprocesseswhicharelisteningonaparticularport

Youcanlisttheprocesseswhicharelisteningonaparticularportbyusingiwith:asfollows

#lsofi:25

COMMANDPIDUSERFDTYPEDEVICESIZENODENAME
exim42541Debianexim3uIPv48677TCPlocalhost:smtp(LISTEN)

http://www.thegeekstuff.com/2012/08/lsof-command-examples 5/13
6/14/2017 15 Linux lsof Command Examples (Identify Open Files)

14.ListallTCPorUDPconnections

YoucanlistalltheTCPorUDPconnectionsbyspecifyingtheprotocolusingi.

#lsofitcp;lsofiudp;

15.ListallNetworkFileSystem(NFS)files

YoucanlistalltheNFSfilesbyusingNoption.ThefollowinglsofcommandwilllistallNFSfilesusedby
userlakshmanan.
#lsofNulakshmanana

62 Tweet Like 72 >Addyourcomment

Ifyouenjoyedthisarticle,youmightalsolike..

1.50LinuxSysadminTutorials AwkIntroduction7AwkPrintExamples
2.50MostFrequentlyUsedLinuxCommands(With AdvancedSedSubstitutionExamples
Examples) 8EssentialVimEditorNavigation
3.Top25BestLinuxPerformanceMonitoringand Fundamentals
DebuggingTools 25MostFrequentlyUsedLinuxIPTables
4.Mommy,Ifoundit!15PracticalLinuxFind RulesExamples
CommandExamples TurbochargePuTTYwith12PowerfulAdd
5.Linux101Hacks2ndEditioneBook Ons

Taggedas:AIXlsof,lsofforWindows,lsofPort

{25commentsaddone}

SrinivasAugust29,2012,10:57am

Hi

Itisgoodarticle.Iknewmostofthelsofoptionbutstilllearnedfewthingsfromthisarticle.Particularly
+doptionandandrepeatmode.

Veryhighlyinformativearticle.

http://www.thegeekstuff.com/2012/08/lsof-command-examples 6/13