Linux Command lsof Usage and 3 Options

by

The Linux command lsof is used to monitor or debug the system’s state, specifically by checking the relationship between files and processes. In this post, we will explain what the lsof command is, in what situations it is used, and cover some commonly used options and precautions.

What is the Linux Command lsof?

lsof, short for “list open files,” is a command that lists all open files in the system. In Linux, everything is treated as a file. This means that directories, network connections, devices, and more are considered files, so lsof helps you see not only regular files but also various system resources currently in use.

It is especially useful in the following scenarios:

  • When you want to check which files a specific process has open
  • When you don’t know which process is using a certain file
  • When you need to check which process is linked to a network port
  • When you want to find processes using deleted files

Thanks to these functions, lsof is widely used as a system monitoring and debugging tool.

Basic Usage

The basic format for the lsof command is quite simple. Just enter the following in the terminal:

lsof
ShellScript

This command will display information about all currently open files. However, in most systems, many files are open, so it is often more efficient to filter the output by specifying certain conditions.

Frequently Used Options

Checking Open Files for a Specific Process (-p Option)

To check which files are open by a process with a specific process ID (PID), use the -p option. For example, to see the open files for the process with PID 1234, you can enter:

lsof -p 1234
ShellScript

This command will list all the files that process 1234 has open. Below is an example where the -p option is applied to the bash process with PID 3152.

Figure 1. Linux command lsof: Using the -p option to list all files opened by PID 3152
Figure 1. Linux command lsof: Using the -p option to list all files opened by PID 3152

Finding the Process Using a Specific File

If you want to know which process is using a specific file, you can directly specify the file path. For example, to find the process using the /var/log/syslog file, enter:

lsof /var/log/syslog
ShellScript

This command will show all processes using that file.

Figure 2. Linux command lsof: Finding the process using a specific file
Figure 2. Linux command lsof: Finding the process using a specific file

Checking Processes Using a Specific Port (-i Option)

When troubleshooting network-related issues, it’s important to find the processes that are using specific ports. For example, to find the process using port 80, enter:

lsof -i :80
ShellScript

This command will display information about the process using that port, which is particularly helpful for network debugging or security checks.

Figure 3. Linux command lsof: Checking processes using a specific port
Figure 3. Linux command lsof: Checking processes using a specific port

Finding Deleted Files

In Linux, even if a file is deleted, it is not fully removed from the system as long as it is still open by a process. To check for deleted files, you can use the following command:

lsof | grep deleted
ShellScript

This command finds files that have been deleted but are still in use. This can be important since disk space might not be freed properly in such cases.

Checking Open Files by User (-u Option)

To see only the files opened by a specific user, use the -u option. For example, to see files opened by the user ‘ito’, you would enter:

lsof -u ito
ShellScript

This command lists all the files opened by that user.

Figure 4. Linux command lsof: Checking open files by user
Figure 4. Linux command lsof: Checking open files by user

Useful Applications

The lsof command is highly useful for system monitoring, network debugging, and file system issue resolution. For instance, you can use it when the file system is not unmounting or when a file isn’t being deleted as expected.

Additionally, running lsof periodically to monitor the system’s state can help you catch potential problems early. Regularly checking network ports or ensuring deleted files are being fully removed are some of the ways you can leverage lsof.

Precautions

Permission Issues

Since the lsof command checks system files and processes, you may need administrative privileges to access certain files or processes. If necessary, you can prepend sudo to the command:

sudo lsof
ShellScript

Large Output

If there are many open files on the system, the output from lsof can be extensive. It’s often useful to filter the results or combine lsof with other tools like grep to display only the information you need.

Figure 5. Using Linux command lsof with grep to filter results
Figure 5. Using Linux command lsof with grep to filter results

Summary

lsof is an incredibly useful command in Linux for monitoring system resources and processes. Whether you are checking which files are open, identifying processes using network ports, or resolving file system issues, lsof can help. By leveraging various options, you can efficiently filter the data to find exactly what you need. It’s a command every system administrator or Linux user should be familiar with, as it is critical for managing the system and troubleshooting problems.

Start using lsof today to deepen your understanding of Linux and quickly respond to any issues that arise.

References

Leave a Comment