UNIX: Usage of lsof

It is a command line utility which is used to list the information about the files that are opened by various processes.

In unix, everything is a file, ( pipes, sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files.

 

List all open files belongs to all active process
# lsof

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 253,2 4096 2 /
init 1 root txt REG 253,2 40816 265018 /sbin/init
init 1 root mem REG 253,2 19173 90134 /lib64/libdl-2.11.3.so
init 1 root 10u FIFO 0,15 0t0 3007 /dev/initctl
kthreadd 2 root cwd DIR 253,2 4096 2 /

 

List processes which opened a specific file
# lsof <Filename>

testlab:/ # lsof /var/log/messages
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslog-ng 1939 root 12w REG 253,5 8668549 57430 /var/log/messages
testlab:/ #

 

List opened files under a directory
# lsof +D <Directory>
# lsof +d <Directory>

You can list the processes which opened files under a specified directory using ‘+D’ option.
+D will recurse the sub directories also. If you don’t want lsof to recurse, then use ‘+d’ option.

 

testlab:/ # lsof +d /var/log/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
snmpd 1808 root 3w REG 253,5 376179 57429 /var/log/net-snmpd.log
syslog-ng 1939 root 4w REG 253,5 8151 57369 /var/log/acpid
syslog-ng 1939 root 6w REG 253,5 1987566 57361 /var/log/mail
syslog-ng 1939 root 8w REG 253,5 2259086 57413 /var/log/warn
syslog-ng 1939 root 9w REG 253,5 423 57364 /var/log/mail.err
syslog-ng 1939 root 10w REG 253,5 338 57363 /var/log/mail.warn
syslog-ng 1939 root 11w REG 253,5 1986805 57362 /var/log/mail.info
syslog-ng 1939 root 12w REG 253,5 8708363 57430 /var/log/messages
mcelog 3356 root 3w REG 253,5 0 57446 /var/log/mcelog
ntpd 3690 ntp 4w REG 253,5 236116 57358 /var/log/ntp
ntpd 3691 root 4w REG 253,5 236116 57358 /var/log/ntp
xrdp-sesm 3928 root 3w REG 253,5 13157 57392 /var/log/xrdp-sesman.log
testlab:/ #

testlab:/ # lsof +D /var/log/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
snmpd 1808 root 3w REG 253,5 376179 57429 /var/log/net-snmpd.log
syslog-ng 1939 root 4w REG 253,5 8151 57369 /var/log/acpid
syslog-ng 1939 root 6w REG 253,5 1987566 57361 /var/log/mail
syslog-ng 1939 root 8w REG 253,5 2259086 57413 /var/log/warn
syslog-ng 1939 root 9w REG 253,5 423 57364 /var/log/mail.err
syslog-ng 1939 root 10w REG 253,5 338 57363 /var/log/mail.warn
syslog-ng 1939 root 11w REG 253,5 1986805 57362 /var/log/mail.info
syslog-ng 1939 root 12w REG 253,5 8708363 57430 /var/log/messages
mcelog 3356 root 3w REG 253,5 0 57446 /var/log/mcelog
ntpd 3690 ntp 4w REG 253,5 236116 57358 /var/log/ntp
ntpd 3691 root 4w REG 253,5 236116 57358 /var/log/ntp
xrdp-sesm 3928 root 3w REG 253,5 13157 57392 /var/log/xrdp-sesman.log
sssd 16919 root 3w REG 253,5 120596756 57410 /var/log/sssd/sssd.log
sssd_be 16920 root 15w REG 253,5 1207953713 57563 /var/log/sssd/sssd_default.log
sssd_be 16920 root 20w REG 253,5 0 57587 /var/log/sssd/ldap_child.log
sssd_nss 16921 root 15w REG 253,5 165968119 57597 /var/log/sssd/sssd_nss.log
sssd_pam 16922 root 15w REG 253,5 0 57628 /var/log/sssd/sssd_pam.log
sssd_auto 16923 root 15w REG 253,5 0 57605 /var/log/sssd/sssd_autofs.log
testlab:/ #

 

List opened files based on process names
# lsof -c <command>
(OR)
# lsof -c <command> -c <command>

You can give multiple -c switch on a single command line

 

testlab:/ # lsof -c init -c bash
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 253,2 4096 2 /
init 1 root rtd DIR 253,2 4096 2 /
init 1 root txt REG 253,2 40816 265018 /sbin/init
init 1 root mem REG 253,2 19173 90134 /lib64/libdl-2.11.3.so
init 1 root mem REG 253,2 1788228 90114 /lib64/libc-2.11.3.so
init 1 root mem REG 253,2 244800 90204 /lib64/libsepol.so.1
init 1 root mem REG 253,2 118080 90393 /lib64/libselinux.so.1
init 1 root mem REG 253,2 155219 90141 /lib64/ld-2.11.3.so
init 1 root 10u FIFO 0,15 0t0 3007 /dev/initctl
bash 31789 root cwd DIR 253,2 4096 2 /
bash 31789 root rtd DIR 253,2 4096 2 /
bash 31789 root txt REG 253,2 588144 516099 /bin/bash
bash 31789 root mem REG 253,2 293936 90188 /lib64/libncurses.so.5.6
bash 31789 root mem REG 253,2 1788228 90114 /lib64/libc-2.11.3.so
bash 31789 root mem REG 253,2 19173 90134 /lib64/libdl-2.11.3.so
bash 31789 root mem REG 253,2 263632 90216 /lib64/libreadline.so.5.2
bash 31789 root mem REG 253,2 155219 90141 /lib64/ld-2.11.3.so
bash 31789 root mem REG 253,2 256324 287626 /usr/lib/locale/en_US.utf8/LC_CTYPE
bash 31789 root mem REG 253,2 1163682 288988 /usr/lib/locale/en_US.utf8/LC_COLLATE
bash 31789 root mem REG 253,5 217016 253998 /var/run/nscd/passwd
bash 31789 root mem REG 253,2 54 287619 /usr/lib/locale/en_US.utf8/LC_NUMERIC
bash 31789 root mem REG 253,2 2454 282102 /usr/lib/locale/en_US.utf8/LC_TIME
bash 31789 root mem REG 253,2 286 282101 /usr/lib/locale/en_US.utf8/LC_MONETARY
bash 31789 root mem REG 253,2 57 295625 /usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES
bash 31789 root mem REG 253,2 34 295639 /usr/lib/locale/en_US.utf8/LC_PAPER
bash 31789 root mem REG 253,2 77 295651 /usr/lib/locale/en_US.utf8/LC_NAME
bash 31789 root mem REG 253,2 155 279720 /usr/lib/locale/en_US.utf8/LC_ADDRESS
bash 31789 root mem REG 253,2 59 295624 /usr/lib/locale/en_US.utf8/LC_TELEPHONE
bash 31789 root mem REG 253,2 23 295640 /usr/lib/locale/en_US.utf8/LC_MEASUREMENT
bash 31789 root mem REG 253,2 26050 197194 /usr/lib64/gconv/gconv-modules.cache
bash 31789 root mem REG 253,2 373 282100 /usr/lib/locale/en_US.utf8/LC_IDENTIFICATION
bash 31789 root 0u CHR 136,0 0t0 3 /dev/pts/0
bash 31789 root 1u CHR 136,0 0t0 3 /dev/pts/0
bash 31789 root 2u CHR 136,0 0t0 3 /dev/pts/0
bash 31789 root 255u CHR 136,0 0t0 3 /dev/pts/0
testlab:/ #

 

List processes using a mount point
# lsof <Mount Point>

testlab:/ # lsof /var
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
snmpd 1808 root 3w REG 253,5 376587 57429 /var/log/net-snmpd.log
syslog-ng 1939 root 12w REG 253,5 22367 57424 /var/log/messages
rpcbind 3238 root 3r REG 253,5 0 253984 /var/run/rpcbind.lock
klzagent 8539 root mem REG 253,5 217016 253999 /var/run/nscd/group
sshd 31787 root mem REG 253,5 217016 253998 /var/run/nscd/passwd
bash 31789 root mem REG 253,5 217016 253998 /var/run/nscd/passwd
Licensing 32306 root mem REG 253,5 217016 253998 /var/run/nscd/passwd
testlab:/ #

 

List files opened by a specific user
# lsof -u <User ID>

testlab:/ # lsof -u root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root txt REG 253,2 40816 265018 /sbin/init
vmtoolsd 2246 root txt REG 253,2 698616 209741 /usr/lib/vmware-tools/sbin64/vmtoolsd
mcelog 3356 root txt REG 253,2 128304 155177 /usr/sbin/mcelog
mingetty 10118 root mem REG 253,5 217016 253999 /var/run/nscd/group
kcawd 13685 root mem REG 253,6 579246 42380 /opt/IBM/ITM/tmaitm6/lx8266/lib/libkbb.so
nfsiod 15515 root txt unknown /proc/15515/exe
bash 31789 root rtd DIR 253,2 4096 2 /
bash 31789 root txt REG 253,2 588144 516099 /bin/bash
Licensing 32306 root txt REG 253,4 2251736 73748 /usr/local/bin/ABBYY/SDK/11/Licensing/LicensingService
testlab:/ #

 

Sometimes, You want to list files opened by all users, expect specfic user.
In that case, you can use ‘^’ to exclude only the particular user

 

testlab:/ # lsof -u ^root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ntpd 3690 ntp 4w REG 253,5 236116 57358 /var/log/ntp
ntpd 3690 ntp 16u IPv6 10440 0t0 UDP *:ntp
atd 3703 at txt REG 253,2 27688 312355 /usr/sbin/atd
atd 3703 at mem REG 253,2 61397 90149 /lib64/libnss_files-2.11.3.so
qmgr 3927 postfix 3r FIFO 0,8 0t0 11577 pipe
qmgr 3927 postfix 4w FIFO 0,8 0t0 11577 pipe
qmgr 3927 postfix 5u unix 0xffff88023011d040 0t0 11497 socket
qmgr 3927 postfix 7u unix 0xffff880230d5e180 0t0 10972 socket
pickup 13163 postfix mem REG 253,2 88752 90156 /lib64/libz.so.1.2.7
pickup 13163 postfix 0u CHR 1,3 0t0 3050 /dev/null
testlab:/ #

 

List all open files by a specific process
# lsof -p <PID>

testlab:/ # lsof -p 3927
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
qmgr 3927 postfix cwd DIR 253,5 4096 114699 /var/spool/postfix
qmgr 3927 postfix rtd DIR 253,2 4096 2 /
qmgr 3927 postfix txt REG 253,2 68832 327879 /usr/lib/postfix/qmgr
qmgr 3927 postfix mem REG 253,5 217016 253999 /var/run/nscd/group
qmgr 3927 postfix 2u CHR 1,3 0t0 3050 /dev/null
qmgr 3927 postfix 4w FIFO 0,8 0t0 11577 pipe
qmgr 3927 postfix 5u unix 0xffff88023011d040 0t0 11497 socket
qmgr 3927 postfix 7u unix 0xffff880230d5e180 0t0 10972 socket
qmgr 3927 postfix 8u 0000 0,9 0 983 anon_inode
qmgr 3927 postfix 11r FIFO 0,8 0t0 11615 pipe
qmgr 3927 postfix 108w FIFO 0,8 0t0 11578 pipe
testlab:/ #

 

List all network connections
# lsof -i

testlab:/ # lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
snmpd 1808 root 7u IPv4 170039931 0t0 TCP localhost:smux (LISTEN)
snmpd 1808 root 9u IPv4 170039932 0t0 UDP *:snmp
rpcbind 3238 root 6u IPv4 9042 0t0 UDP *:sunrpc
rpcbind 3238 root 7u IPv4 9046 0t0 UDP *:869
sshd 3669 root 3u IPv4 9354 0t0 TCP *:ssh (LISTEN)
sshd 3669 root 4u IPv6 9356 0t0 TCP *:ssh (LISTEN)
ntpd 3690 ntp 16u IPv6 10440 0t0 UDP *:ntp
ntpd 3690 ntp 17u IPv4 10443 0t0 UDP *:ntp
ntpd 3690 ntp 18u IPv4 10448 0t0 UDP localhost:ntp
ntpd 3690 ntp 19u IPv4 10450 0t0 UDP 127.0.0.2:ntp
rpc.mount 3774 root 7u IPv4 9487 0t0 UDP *:55000
rpc.mount 3774 root 8u IPv4 9491 0t0 TCP *:55000 (LISTEN)
Licensing 32306 root 0u IPv4 64310526 0t0 TCP *:broker-service (LISTEN)
testlab:/ #

 

List all network files in use by a specific process
# lsof -i -a -p <Port Number>

tlv10-bat1:/ # lsof -i -a -p 3690
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ntpd 3690 ntp 16u IPv6 10440 0t0 UDP *:ntp
ntpd 3690 ntp 17u IPv4 10443 0t0 UDP *:ntp
ntpd 3690 ntp 18u IPv4 10448 0t0 UDP localhost:ntp
ntpd 3690 ntp 19u IPv4 10450 0t0 UDP 127.0.0.2:ntp
ntpd 3690 ntp 20u IPv4 10452 0t0 UDP tlv10-bat1.walgreens.com:ntp
ntpd 3690 ntp 21u IPv6 10454 0t0 UDP localhost:ntp
ntpd 3690 ntp 22u IPv6 10456 0t0 UDP [fe80::250:56ff:febb:7730]:ntp
tlv10-bat1:/ #

 

List processes which are listening on a particular port
# lsof -i :<Port Number>

tlv10-bat1:/ # lsof -i :25
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
master 3901 root 12u IPv4 11486 0t0 TCP localhost:smtp (LISTEN)
master 3901 root 13u IPv6 11488 0t0 TCP localhost:smtp (LISTEN)
tlv10-bat1:/ #