The Linux tool, lsof, enables quick system mon­it­or­ing and problem detection. It provides a list of open files, allowing you to optimise it for your specific needs using filters and options.

What is Linux lsof?

To monitor and analyse your Linux system, lsof is an easy-to-use tool. The program, developed and published in 1994 by Vic Abell, is open source and is part of the standard in­stall­a­tion for numerous Linux dis­tri­bu­tions, such as Debian or Ubuntu. lsof stands for ‘List open files’. The program provides in­form­a­tion about file types that are currently open or were pre­vi­ously opened by running processes. This includes regular files, dir­ect­or­ies, sockets, drives, and ports. It presents a clear and organised list of the different processes and as­so­ci­ated files.

How does Linux lsof work?

If lsof is not present on your system, simply install it with this Linux command:

$ apt-get install lsof
bash

Once installed, Linux lsof lets you to obtain a com­pre­hens­ive overview of the active processes on your computer. This is possible because, under Unix-like systems, everything is treated as a file. As a result, you can use lsof to determine which processes can access a specific file.

What does the Isof syntax look like?

Want to use lsof? This is the basic syntax of the cor­res­pond­ing command:

$ lsof [Option] <Format>
bash

While it is possible to use lsof without options or filters, it’s not advisable. The resulting output would be extensive and difficult to interpret.

Which options and filters are available with Linux lsof?

lsof un­der­stands numerous output options. The most important ones are:

  • -F: This option ensures that all results are output in a single column.
  • -l: This option lets you display the user ID instead of the name.
  • -n: Using this option, the cor­res­pond­ing IP addresses are output instead of hostnames.
  • -P: This is how the port numbers are displayed instead of the service names.
  • -r [x]: This option ensures that the output is re-executed every x seconds.
  • -t: With this option only a PID list (Process Iden­ti­fi­er) is output.

In addition, lsof knows numerous filter options. The most common ones are:

  • -a: This is a logical AND operation instead of the OR operation; it’s used by default.
  • -c [Process]: Find out which file is used by which process.
  • +D /file/user: This filter provides in­form­a­tion about a specific directory and its user.
  • /dev/drive: Use this filter to check a specific drive.
  • -i [TCP/UDP or al­tern­at­ive IP address or port]: Provides in­form­a­tion about which processes use which network services.
  • +L1: Use this filter to get in­form­a­tion about deleted files.
  • +p PID: Provides in­form­a­tion about the files used by which PID.
  • /path/file: Provides in­form­a­tion about a specific file.
  • -u [User]: Find out which user is using which files.

What is Linux lsof being used for?

To conclude, we’ll show you how and for what lsof is being used by means of some examples.

$ lsof -u root
bash

This lets you view all files that root currently keeps open.

$ lsof /mount/path
bash

Fre­quently, lsof is used to identify programs that prevent the execution of the mount command. This task cannot be ac­com­plished if related files are still open.

$ lsof -n -i
bash

This command lets you list all open ports.

Go to Main Menu