Skip to main content

lsof command

lsof - list open files​

The lsof command in Linux (short for "list open files") is a powerful tool used to display information about files opened by processes. In Linux, "files" include regular files, directories, network sockets, pipes, and more. It’s invaluable for troubleshooting, finding which process is using a file, or identifying network connections.

Note: lsof may not be installed by default. Install it with sudo apt install lsof (Debian/Ubuntu) or sudo yum install lsof (CentOS/RHEL).

Usage: lsof [options] [file|directory|criteria]

  • file|directory: Optional target to filter by.
  • criteria: Filters like user, PID, or port.
  • options: Flags to refine output or behavior.

Common Options

OptionDescription
-pFilter by PID
-uFilter by user
-iShow network files (sockets)
-aCombine filters (AND logic)
-tOutput only PIDs (for scripts)
-nAvoid DNS lookups (faster)
-PShow port numbers, not service names

Examples​

  • Basic Usage

    Run lsof without arguments to list all open files on the system.

    lsof
    • Output (partial): 
      COMMAND   PID  USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
      systemd     1  root  cwd    DIR    8,1     4096     2 /
      bash     1234 alice  cwd    DIR    8,1     4096 12345 /home/alice
      firefox  5678 alice   10u  IPv4  12345      0t0   TCP 192.168.1.100:54321->142.250.190.78:http
    • Explanation:
      • COMMAND: Process name.
      • PID: Process ID.
      • USER: Owner.
      • FD: File descriptor (e.g., cwd = current working directory, 10u = file/socket).
      • TYPE: File type (e.g., DIR, REG, IPv4).
      • NAME: File or resource path.

  • Files Opened by a Process

    Use -p to list files opened by a specific PID.

    lsof -p 1234
    • Shows all files opened by PID 1234 (e.g., a bash process).

  • Files Opened by a User

    Use -u to filter by username.

    lsof -u alice
    • Lists all files opened by user alice.

  • Files Using a Specific File or Directory

    Pass a path to see which processes are using it.

    lsof /var/log/syslog
    • Output: 
      COMMAND  PID USER  FD   TYPE DEVICE SIZE/OFF   NODE NAME
      rsyslogd 789 root  4w   REG    8,1   123456 67890 /var/log/syslog
    • Shows rsyslogd is writing to /var/log/syslog.

  • Network Connections

    Use -i to list network-related files (sockets).

    lsof -i
    • Output: 
      COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
      sshd    1234 root    3u  IPv4  56789      0t0  TCP *:22 (LISTEN)
      firefox 5678 alice  10u  IPv4  90123      0t0  TCP 192.168.1.100:54321->142.250.190.78:http

    Process running on Specific Port:

    lsof -i :22
    • Shows processes using port 22 (SSH).

  • Combining Filters

    Mix options for precise results.

    lsof -u alice -i
    • Lists network connections opened by alice.

  • Finding Processes Blocking a Mount Point

    Check what’s preventing an unmount.

    lsof /mnt/usb
    • Lists processes using /mnt/usb (e.g., an open terminal).

To get help related to the lsof command use --help option​

$ lsof --help
lsof: illegal option character: -
lsof: -e not followed by a file system path: "lp"
lsof 4.93.2
 latest revision: https://github.com/lsof-org/lsof
 latest FAQ: https://github.com/lsof-org/lsof/blob/master/00FAQ
 latest (non-formatted) man page: https://github.com/lsof-org/lsof/blob/master/Lsof.8
 usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-E] [+|-e s] [+|-f[gG]]
 [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
 [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]
Defaults in parentheses; comma-separated set (s) items; dash-separated ranges.
  -?|-h list help          -a AND selections (OR)     -b avoid kernel blocks
  -c c  cmd c ^c /c/[bix]  +c w  COMMAND width (9)    +d s  dir s files
  -d s  select by FD set   +D D  dir D tree *SLOW?*   +|-e s  exempt s *RISKY*
  -i select IPv[46] files  -K [i] list|(i)gn tasKs    -l list UID numbers
  -n no host names         -N select NFS files        -o list file offset
  -O no overhead *RISKY*   -P no port names           -R list paRent PID
  -s list file size        -t terse listing           -T disable TCP/TPI info
  -U select Unix socket    -v list version info       -V verbose search
  +|-w  Warnings (+)       -X skip TCP&UDP* files     -Z Z  context [Z]
  -- end option scan
  -E display endpoint info              +E display endpoint info and files
  +f|-f  +filesystem or -file names     +|-f[gG] flaGs
  -F [f] select fields; -F? for help
  +|-L [l] list (+) suppress (-) link counts < l (0 = all; default = 0)
                                        +m [m] use|create mount supplement
  +|-M   portMap registration (-)       -o o   o 0t offset digits (8)
  -p s   exclude(^)|select PIDs         -S [t] t second stat timeout (15)
  -T qs TCP/TPI Q,St (s) info
  -g [s] exclude(^)|select and print process group IDs
  -i i   select by IPv[46] address: [46][proto][@host|addr][:svc_list|port_list]
  +|-r [t[m<fmt>]] repeat every t seconds (15);  + until no files, - forever.
       An optional suffix to t is m<fmt>; m must separate t from <fmt> and
      <fmt> is an strftime(3) format for the marker line.
  -s p:s  exclude(^)|select protocol (p = TCP|UDP) states by name(s).
  -u s   exclude(^)|select login|UID set s
  -x [fl] cross over +d|+D File systems or symbolic Links
  names  select named files or files on named file systems
Anyone can list all files; /dev warnings disabled; kernel ID check disabled.

For more details, check the manual with man lsof

Last updated on by AB