31 Most Useful lsof Command in Linux (list Open Files)

Understanding the inner workings of a Linux system is crucial for system administrators and enthusiasts alike. The “lsof” command, short for “list open files,” is a powerful tool for monitoring and troubleshooting processes on a Linux system. It provides detailed information about files and processes that are currently open, facilitating a deeper understanding of system activities. In this article, we’ll explore 30 simple and effective lsof commands, accompanied by command examples and detailed explanations of their output.

The Basic Syntax for top command in Linux:

The global syntax for the lsof command in Linux is as follows:

lsof [options] [files or directories]

Here’s a breakdown of the components:

• lsof: The basic command to list open files and associated processes.
• [options]: Optional flags or parameters that modify the behavior of the lsof command. These options provide various filters and controls for the information displayed.
• [files or directories]: Optional argument specifying the files or directories for which information is to be displayed. If no files or directories are provided, lsof will list all open files on the system.

Most Useful lsof Command in Linux

1. List all open files:

This command provides a comprehensive list of all open files in the system. The output includes information such as the process ID (PID), file descriptor (FD), type of file (REG for regular file, DIR for directory), and the file path.

lsof

Output:

COMMAND   PID  USER   FD      TYPE             DEVICE SIZE/OFF    NODE NAME
init        1 root  cwd       DIR                8,1     4096       2 /
init        1 root  rtd       DIR                8,1     4096       2 /
init        1 root  txt       REG                8,1   154176  178521 /sbin/init
...

In the output, you can see details such as the command name, process ID, user, file descriptor, file type, device, size/off (size or offset), node, and the file name or path.

2. Show open files for a specific process (PID):

Replace <PID> with the process ID you’re interested in. This command narrows down the output to display only the open files associated with a specific process. It provides detailed information on the files, including their type, size, and the processes using them.

lsof -p <PID>

Output:

COMMAND   PID USER  FD  TYPE DEVICE SIZE/OFF    NODE NAME
bash    12345 user cwd   DIR    8,1     4096 1234567 /home/user
bash    12345 user rtd   DIR    8,1     4096 1234567 /home/user
bash    12345 user txt   REG    8,1   947660  987654 /bin/bash
...

The output provides details about open files associated with the specified process, including the file descriptor, file type, device, size/off, node, and file name or path.

3. List files opened by a specific user:

Replace <username> with the desired username. This command filters the output to show only the files opened by a specific user. It’s useful for understanding the file activities of a particular user on the system.

lsof -u <username>

Output:

COMMAND   PID  USER   FD  TYPE             DEVICE SIZE/OFF    NODE NAME
bash    12345 usmk   cwd   DIR                8,1     4096 1234567 /home/user
bash    12345 usmk   rtd   DIR                8,1     4096 1234567 /home/user
bash    12345 usmk   txt   REG                8,1   947660  987654 /bin/bash
...

The output shows files opened by processes owned by the specified user, including details about the command, process ID, file descriptor, file type, device, size/off, node, and file name or path.

4. Display open files in a specific directory:

By providing the path to a directory, this command shows a list of files opened within that directory. It’s beneficial for understanding which processes are interacting with files in a particular location.

lsof /path/to/directory

Output:

COMMAND   PID  USER   FD  TYPE DEVICE SIZE/OFF    NODE NAME
bash    12345 user   cwd  DIR    8,1     4096 1234567 /path/to/directory
cat     23456 user   1w   REG    8,1       23 9876543 /path/to/directory/example.txt
...

The output displays open files associated with processes operating within the specified directory.

5. Show network connections and their details:

This command lists all open network connections on the system. It provides information about the processes, protocol, local and remote addresses, and the state of each connection. It’s invaluable for network troubleshooting and understanding network-related activities on the system.

lsof -i

Output:

COMMAND   PID   USER      FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd     1234   root      3u   IPv4  123456      0t0  TCP *:22 (LISTEN)
sshd     1234   root      4u   IPv6  123457      0t0  TCP *:22 (LISTEN)
nginx    5678   www-data  7u   IPv4  987654      0t0  TCP 192.168.1.2:80->192.168.1.1:54321 (ESTABLISHED)
...

The output provides information about processes with open network connections, including the protocol, local and remote addresses, and connection state.

6. Display files opened by a specific command:

Replace <command_name> with the name of the command. This command filters the output to show files opened exclusively by processes running the specified command. It’s helpful for understanding which files a particular command is interacting with.

lsof -c <command_name>

The output of this command will shows files opened by processes running the specified command, including details about the command, process ID, file descriptor, file type, device, size/off, node, and file name or path.

7. List open files for a specific user and process combination:

By combining the -u and -c options, you can narrow down the output to display files opened by a specific user and command. This is useful for pinpointing the files associated with a particular user executing a specific command.

lsof -u <username> -c <command_name>

8. Show files opened by a specific process and its children:

Replace <parent_pid> with the process ID of the parent. This command displays files opened by the specified process and its child processes. It provides a hierarchical view of file interactions, which can be crucial for understanding the broader impact of a process.

lsof -g <parent_pid>

9. Display network connections using a specific port:

Replace <port_number> with the desired port. This command helps identify processes that are using a specific network port. It’s essential for troubleshooting network-related issues and understanding which processes are communicating over a particular port.

lsof -i :<port_number>

10. List files opened by a specific user and process group:

By combining the -u and -g options, you can filter the output to show files opened by a specific user and process group. This is beneficial for understanding the file activities of a particular user within a specific process group.

lsof -u <username> -g <process_group>

11. Show files opened by processes with a specific command in the name:

This command allows you to display files opened by processes whose command names match a partial string. It’s useful when you want to investigate the file interactions of processes with similar command names.

lsof -c <partial_command_name>

12. Display open files with IPv6 connections:

When working in an environment that utilizes IPv6, this command focuses on listing open files associated with IPv6 network connections. It helps ensure visibility into processes using IPv6 addresses.

lsof -i6

13. List files opened by processes in a specific directory tree:

The +D option, followed by the directory path, lists files opened within the specified directory and its subdirectories. This is particularly useful for examining file activities in a specific directory hierarchy.

lsof +D /path/to/directory

14. Show files opened by a specific user and process excluding a particular command:

By using the ^ symbol, you can exclude processes with a specific command from the results. This is beneficial when you want to focus on a user’s file interactions while excluding those related to a particular command.

lsof -u <username> -c ^<exclude_command>

15. Display files opened by a specific process and its descendants:

Similar to command 8, this command displays files opened by the specified process and its descendant processes. The ^ symbol excludes processes with a specific parent PID from the results.

lsof -g ^<parent_pid>

16. List open files by process name and its arguments:

By combining the -c and -a options, along with specifying the user (-u), this command shows files opened by processes with the specified name and arguments. It provides a more detailed view of processes with specific command attributes.

lsof -c <command_name> -a -u

17. Show network connections excluding specific IP addresses:

The -i option with the ^ symbol allows you to exclude specific IP addresses from the results. This is useful when you want to focus on network connections while excluding those associated with certain IPs.

lsof -i -a -i ^<excluded_ip>

18. Display files opened by a specific user on a specific host:

This command specify both user and host to narrow down the results.

lsof -u <username> -h <hostname>

19. List open files by process name and its executable path:

Combining the -c and -d options, this command displays files opened by processes with the specified name and executable path ending in “.txt”. It helps identify processes interacting with specific types of executable files.

lsof -c <command_name> -a -d txt

20. Show network connections with a specific protocol:

Replace <protocol> with the desired network protocol (e.g., tcp, udp). This command filters the output to display network connections using a specific protocol, providing insights into processes utilizing that protocol.

lsof -i <protocol>

21. Display files opened by processes running on a specific processor (CPU affinity):

The -A option followed by the CPU number allows you to view files opened by processes running on a specific processor. This is particularly useful in environments where CPU affinity is configured.

lsof -A <cpu_number>

22. List open files with specific file descriptor types:

Replace <file_descriptor_type> with the desired file descriptor type (e.g., cwd, mem). This command filters the output to show only files opened with the specified types of file descriptors, providing insights into specific aspects of file interactions.

lsof -d <file_descriptor_type>

23. Show network connections using a specific service name:

The -s option followed by the service name allows you to filter network connections based on services. This is particularly helpful for identifying processes associated with specific network services.

lsof -i -s <service_name>

24 Display files opened by a specific user, process, and excluding a certain command:

This command combines options to include specific user, process, and exclude a particular command. It provides a detailed view of file interactions for a user within a specific process while excluding a specific command.

lsof -u <username> -c ^<exclude_command> -p <PID>

25. Display network connections using a specific IP version (IPv4 or IPv6):

Specify the IP version (4 or 6) to filter results based on the version of the IP protocol. This command is helpful for distinguishing between IPv4 and IPv6 network connections.

lsof -i <ip_version>

26. Show files opened by processes running on a specific set of processors:

This command allows you to view files opened by processes running on the specified set of processors. It provides insights into file activities on specific CPU cores.

lsof -a -A <cpu_list>

27. List files opened by processes using a specific file system type and device:

Combining the -F and -b options, this command displays files opened by processes using a specific file system type and associated with a particular device. It’s useful for analyzing file interactions on a specific storage device.

lsof -F <file_system_type> -b <device>

28. Display network connections with a specific state:

Replace <connection_state> with the desired network connection state (e.g., LISTEN, ESTABLISHED). This command filters network connections based on their state, aiding in the identification of specific connection statuses.

lsof -i -s <connection_state>

29. List open files with specific access modes (read, write, execute):

Combining the -a and -r options, this command filters the output to show files opened with specific access modes (e.g., r for read, w for write, x for execute). It helps identify processes with specific file access permissions.

lsof -a -r <access_mode>

31. Show files opened by processes using a specific file system type and excluding a certain device:

Combining the -F and -b options with the ^ symbol, this command displays files opened by processes using a specific file system type while excluding those associated with a particular device. It’s useful for focusing on file interactions on specific file system types, excluding unwanted devices.

lsof -F <file_system_type> -b ^<exclude_device>

The “lsof” command is an invaluable tool for system administrators, providing insights into the open files, network connections, and processes on a Linux system. By mastering these 40 simple and effective “lsof” commands, you can enhance your ability to troubleshoot issues, monitor system activity, and gain a deeper understanding of your system’s inner workings. Experiment with these commands in different scenarios to become proficient in leveraging “lsof” for efficient system analysis.

If you encounter any challenges or have questions regarding the “lsof” commands discussed in this article, feel free to drop a comment below. I’ll do my best to assist you and provide further clarification.

If you found this guide helpful and informative, don’t forget to give it a thumbs up! Your feedback is crucial, and it encourages the creation of more content to help you navigate the intricacies of Linux system administration.

Share this article with your peers and fellow Linux enthusiasts who might benefit from these “lsof” command insights. Spread the knowledge and contribute to building a community of skilled Linux users.

Stay tuned for more articles, tips, and tricks to enhance your Linux expertise. Happy exploring and mastering the world of “lsof” commands!