7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Home About Free eBook Archives Best of the Blog Contact

15 Linux lsof Command Examples (Identify Open Files)

by Lakshmanan Ganapathy on August 29, 2012
57 Like 28 Tw eet 61

lsof stands for List Open Files. It is easy to remember lsof command if you think of it as ls + of, where ls stands for list, and of stands for open files. It is a command line utility which is used to list the information about the files that are opened by various processes. In unix, everything is a file, ( pipes, sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files.

1. Introduction to lsof
www.thegeekstuff.com/2012/08/lsof-command-examples/ 1/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Simply typing lsof will provide a list of all open files belonging to all active processes.
#l s o f C O M M A N D P I D i n i t 1 i n i t 1 i n i t 1 i n i t 1 i n i t 1 i n i t 1 . . . U S E R F D r o o t c w d r o o t t x t r o o t 0 u r o o t 1 u r o o t 2 u r o o t 3 r T Y P E D I R R E G C H R C H R C H R F I F O D E V I C E S I Z E / O F F 8 , 1 4 0 9 6 8 , 1 1 2 4 7 0 4 1 , 3 0 t 0 1 , 3 0 t 0 1 , 3 0 t 0 0 , 8 0 t 0 N O D EN A M E 2/ 9 1 7 5 6 2/ s b i n / i n i t 4 3 6 9/ d e v / n u l l 4 3 6 9/ d e v / n u l l 4 3 6 9/ d e v / n u l l 6 3 2 3p i p e

By default One file per line is displayed. Most of the columns are self explanatory. We will explain the details about couple of cryptic columns (FD and TYPE). FD Represents the file descriptor. Some of the values of FDs are, cwd Current Working Directory txt Text file mem Memory mapped file mmap Memory mapped device NUMBER Represent the actual file descriptor. The character after the number i.e 1u, represents the mode in which the file is opened. r for read, w for write, u for read and write. TYPE Specifies the type of the file. Some of the values of TYPEs are,

www.thegeekstuff.com/2012/08/lsof-command-examples/

2/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

REG Regular File DIR Directory FIFO First In First Out CHR Character special file For a complete list of FD & TYPE, refer man lsof.

2. List processes which opened a specific file

You can list only the processes which opened a specific file, by providing the filename as arguments.
#l s o f/ v a r / l o g / s y s l o g C O M M A N D P I D U S E R r s y s l o g d4 8 8s y s l o g F D T Y P ED E V I C ES I Z E / O F F N O D EN A M E 1 w R E G 8 , 1 1 1 5 12 6 8 9 4 0/ v a r / l o g / s y s l o g

3. List opened files under a directory

You can list the processes which opened files under a specified directory using +D option. +D will recurse the sub directories also. If you dont want lsof to recurse, then use +d option.
#l s o f+ D/ v a r / l o g /
www.thegeekstuff.com/2012/08/lsof-command-examples/ 3/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

C O M M A N D P I D U S E R F D T Y P ED E V I C ES I Z E / O F F N O D EN A M E r s y s l o g d 4 8 8s y s l o g 1 w R E G 8 , 1 1 1 5 12 6 8 9 4 0/ v a r / l o g / s y s l o g r s y s l o g d 4 8 8s y s l o g 2 w R E G 8 , 1 2 4 0 52 6 9 6 1 6/ v a r / l o g / a u t h . l o g c o n s o l e k1 4 4 r o o t 9 w R E G 8 , 1 1 0 8 7 12 6 9 3 6 9/ v a r / l o g / C o n s o l e K i t / h i s t o r y

4. List opened files based on process names starting with

You can list the files opened by process names starting with a string, using -c option. -c followed by the process name will list the files opened by the process starting with that processes name. You can give multiple -c switch on a single command line.
#l s o fcs s hci n i t C O M M A N D P I D U S E R F D T Y P ED E V I C ES I Z E / O F F N O D EN A M E i n i t 1 r o o t t x t R E G 8 , 1 1 2 4 7 0 4 9 1 7 5 6 2/ s b i n / i n i t i n i t 1 r o o t m e m R E G 8 , 1 1 4 3 4 1 8 01 4 4 2 6 2 5/ l i b / i 3 8 6 l i n u x g n u / l i b c 2 . 1 3 . s o i n i t 1 r o o t m e m R E G 8 , 1 3 0 6 8 41 4 4 2 6 9 4/ l i b / i 3 8 6 l i n u x g n u / l i b r t 2 . 1 3 . s o . . . s s h a g e n t1 5 2 8l a k s h m a n a n 1 u C H R 1 , 3 0 t 0 4 3 6 9/ d e v / n u l l s s h a g e n t1 5 2 8l a k s h m a n a n 2 u C H R 1 , 3 0 t 0 4 3 6 9/ d e v / n u l l s s h a g e n t1 5 2 8l a k s h m a n a n 3 u u n i x0 x d f 7 0 e 2 4 0 0 t 0 1 0 4 6 4/ t m p / s s h s U y m K X x w 1 4 9 5 / a g e n t . 1 4 9 5

5. List processes using a mount point

Sometime when we try to umount a directory, the system will say Device or Resource Busy error. So we need to find out what are all the processes using the mount point and kill those processes to umount the directory. By using lsof we can find those processes.
#l s o f/ h o m e

The following will also work.

#l s o f+ D/ h o m e /

6. List files opened by a specific user

In order to find the list of files opened by a specific users, use -u option.
#l s o ful a k s h m a n a n
www.thegeekstuff.com/2012/08/lsof-command-examples/ 4/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

C O M M A N D P I D U S E R F D T Y P E u p d a t e n o1 8 9 2l a k s h m a n a n 2 0 r F I F O u p d a t e n o1 8 9 2l a k s h m a n a n 2 1 w F I F O b a s h 1 9 9 5l a k s h m a n a n c w d D I R

D E V I C ES I Z E / O F F 0 , 8 0 t 0 0 , 8 0 t 0 8 , 1 4 0 9 6

N O D EN A M E 1 4 5 3 6p i p e 1 4 5 3 6p i p e 3 9 3 2 1 8/ h o m e / l a k s h m a n a n

Sometimes you may want to list files opened by all users, expect some 1 or 2. In that case you can use the ^ to exclude only the particular user as follows
#l s o fu^ l a k s h m a n a n C O M M A N D P I D r t k i t d a e1 3 8 0 u d i s k s d a1 5 8 4 U S E R F D r t k i t 7 u r o o t c w d T Y P E 0 0 0 0 D I R D E V I C E S I Z E / O F F 0 , 9 0 8 , 1 4 0 9 6 N O D EN A M E 4 3 6 0a n o n _ i n o d e 2/

The above command listed all the files opened by all users, expect user lakshmanan.

7. List all open files by a specific process

You can list all the files opened by a specific process using -p option. It will be helpful sometimes to get more information about a specific process.
#l s o fp1 7 5 3 C O M M A N D P I D U S E R F D T Y P ED E V I C ES I Z E / O F F N O D EN A M E b a s h 1 7 5 3l a k s h m a n a n c w d D I R 8 , 1 4 0 9 6 3 9 3 5 7 1/ h o m e / l a k s h m a n a n / t e s t . t x t b a s h 1 7 5 3l a k s h m a n a n r t d D I R 8 , 1 4 0 9 6 2/ b a s h 1 7 5 3l a k s h m a n a n 2 5 5 u C H R 1 3 6 , 0 0 t 0 3/ d e v / p t s / 0 . . .

8. Kill all process that belongs to a particular user

When you want to kill all the processes which has files opened by a specific user, you can use -t option to list output only the process id of the process, and pass it to kill as follows
#k i l l9` l s o ftul a k s h m a n a n `

The above command will kill all process belonging to user lakshmanan, which has files opened. Similarly you can also use -t in many ways. For example, to list process id of a process which opened /var/log/syslog can be done by
www.thegeekstuff.com/2012/08/lsof-command-examples/ 5/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

#l s o ft/ v a r / l o g / s y s l o g 4 8 9

Talking about kill, did you know that there are 4 Ways to Kill a Process?

9. Combine more list options using OR/AND

By default when you use more than one list option in lsof, they will be ORed. For example,
#l s o ful a k s h m a n a nci n i t C O M M A N D i n i t i n i t b a s h b a s h . . . P I D U S E R F D T Y P E 1 r o o t c w d D I R 1 r o o t t x t R E G 1 9 9 5l a k s h m a n a n 2 u C H R 1 9 9 5l a k s h m a n a n 2 5 5 u C H R D E V I C ES I Z E / O F F 8 , 1 4 0 9 6 8 , 1 1 2 4 7 0 4 1 3 6 , 2 0 t 0 1 3 6 , 2 0 t 0 N O D EN A M E 2/ 9 1 7 5 6 2/ s b i n / i n i t 5/ d e v / p t s / 2 5/ d e v / p t s / 2

The above command uses two list options, -u and -c. So the command will list process belongs to user lakshmanan as well as process name starts with init. But when you want to list a process belongs to user lakshmanan and the process name starts with init, you can use -a option.
#l s o ful a k s h m a n a nci n i ta

The above command will not output anything, because there is no such process named init belonging to user lakshmanan.

10. Execute lsof in repeat mode

lsof also support Repeat mode. It will first list files based on the given parameters, and delay for specified seconds and again list files based on the given parameters. It can be interrupted by a signal. Repeat mode can be enabled by using -r or +r. If +r is used then, the repeat mode will end when no open files are found. -r will continue to list,delay,list until a interrupt is given irrespective of files are opened or not. Each cycle output will be separated by using =======. You also also specify the time delay as -r | +r.
#l s o ful a k s h m a n a nci n i tar 5
www.thegeekstuff.com/2012/08/lsof-command-examples/ 6/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

= = = = = = = = = = = = = = C O M M A N D P I D U S E R i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n i n i t a . s h2 9 7 1l a k s h m a n a n = = = = = = =

F D T Y P ED E V I C ES I Z E / O F F N O D EN A M E c w d D I R 8 , 1 4 0 9 6 3 9 3 2 1 8/ h o m e / l a k s h m a n a n r t d D I R 8 , 1 4 0 9 6 2/ t x t R E G 8 , 1 8 3 8 4 8 5 2 4 3 1 5/ b i n / d a s h m e m R E G 8 , 1 1 4 3 4 1 8 01 4 4 2 6 2 5/ l i b / i 3 8 6 l i n u x g n u / l i b c 2 . 1 3 . s o m e m R E G 8 , 1 1 1 7 9 6 01 4 4 2 6 1 2/ l i b / i 3 8 6 l i n u x g n u / l d 2 . 1 3 . s o 0 u C H R 1 3 6 , 4 0 t 0 7/ d e v / p t s / 4 1 u C H R 1 3 6 , 4 0 t 0 7/ d e v / p t s / 4 2 u C H R 1 3 6 , 4 0 t 0 7/ d e v / p t s / 4 1 0 r R E G 8 , 1 2 0 3 9 3 5 7 8/ h o m e / l a k s h m a n a n / i n i t a . s h

In the above output, for the first 5 seconds, there is no output. After that a script named inita.sh is started, and it list the output.

Finding Network Connection

Network connections are also files. So we can find information about them by using lsof.

11. List all network connections

You can list all the network connections opened by using -i option.
#l s o fi C O M M A N D P I D U S E R a v a h i d a e 5 1 5a v a h i a v a h i d a e 5 1 5a v a h i c u p s d 1 0 7 5 r o o t F D 1 3 u 1 6 u 5 u T Y P ED E V I C ES I Z E / O F FN O D EN A M E I P v 4 6 8 4 8 0 t 0 U D P* : m d n s I P v 6 6 8 5 1 0 t 0 U D P* : 5 2 0 6 0 I P v 6 2 2 5 1 2 0 t 0 T C Pi p 6 l o c a l h o s t : i p p( L I S T E N )

You can also use -i4 or -i6 to list only IPV4 or IPV6 respectively.

12. List all network files in use by a specific process

You can list all the network files which is being used by a process as follows
#l s o fiap2 3 4
www.thegeekstuff.com/2012/08/lsof-command-examples/ 7/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

You can also use the following

#l s o fiacs s h

The above command will list the network files opened by the processes starting with ssh.

13. List processes which are listening on a particular port

You can list the processes which are listening on a particular port by using -i with : as follows
#l s o fi: 2 5 C O M M A N D P I D U S E R e x i m 4 2 5 4 1D e b i a n e x i m F D T Y P ED E V I C ES I Z EN O D EN A M E 3 u I P v 4 8 6 7 7 T C Pl o c a l h o s t : s m t p( L I S T E N )

14. List all TCP or UDP connections

You can list all the TCP or UDP connections by specifying the protocol using -i.
#l s o fit c p ;l s o fiu d p ;

15. List all Network File System ( NFS ) files

You can list all the NFS files by using -N option. The following lsof command will list all NFS files used by user lakshmanan.
#l s o fNul a k s h m a n a na
57 Tw eet 61 Like 28

> Add your comment

www.thegeekstuff.com/2012/08/lsof-command-examples/

8/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you dont know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator. Get the Linux Sysadmin Course Now!

If you enjoyed this article, you might also like..

1. 2. 3. 4. 5. 50 Linux Sysadmin Tutorials 50 Most Frequently Used Linux Commands (With Examples) Top 25 Best Linux Performance Monitoring and Debugging Tools Mommy, I found it! 15 Practical Linux Find Command Examples Linux 101 Hacks 2nd Edition eBook Awk Introduction 7 Awk Print Examples Advanced Sed Substitution Examples 8 Essential Vim Editor Navigation Fundamentals 25 Most Frequently Used Linux IPTables Rules Examples Turbocharge PuTTY with 12 Powerful Add-Ons

www.thegeekstuff.com/2012/08/lsof-command-examples/

9/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Tags: AIX lsof, lsof for Windows, lsof Port { 11 comments read them below or add one } 1 Srinivas August 29, 2012 at 10:57 am Hi It is good article. I knew most of the lsof option but still learned few things from this article. Particularly +d option and and repeat mode. Very highly informative article. Would it be possible to write about complex one liners which gives much more information? Like using lsof command to generate top 10 files opened processes etc. Srinivas 2 raghavan August 29, 2012 at 3:29 pm Excellent tutorial again. May be you could write a second part going in detail about the various columns (FD, TYPE, DEVICE, SIZE/OFF). I generally do prefer netstat over lsof for information on networking. 3 Manojkumar August 30, 2012 at 12:08 am Nice to recall the options once again. 4 Ankit August 30, 2012 at 1:54 am Good tutorial, i just encountered the need to use the command today and here I found the good tutorial. Thanks. 5 niraj August 30, 2012 at 2:33 am informative and nice article .
www.thegeekstuff.com/2012/08/lsof-command-examples/ 10/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

6 Adorn August 30, 2012 at 10:18 pm Very good tutorial..! Keep on posting.. 7 Ethan August 31, 2012 at 6:08 pm very good article. Linux belong to all of us interested in it. 8 Mark September 2, 2012 at 7:14 am This is good information. On larger systems where root or oracle have lots of files open, I use these commands to properly tune my systems ulimits. Thanks. **Read more on ulimits before proceeding. 9 Jalal Hajigholamali September 5, 2012 at 9:45 pm Hi, Very good article, thanks a lot 10 Leenus December 14, 2012 at 10:48 pm Nice article, thanks a lot for the author of this book. 11 Dhamudba February 14, 2013 at 12:54 pm ThanksIts useful. Leave a Comment Name E-mail Website

www.thegeekstuff.com/2012/08/lsof-command-examples/

11/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Notify me of followup comments via e-mail

Submit

Previous post: C Linked List Data Structure Explained with an Example C Program Next post: Linux uname Command Examples (Get Kernel version, release, hostname, etc)

Search

>Email >RSS >Twitter >Facebook

www.thegeekstuff.com/2012/08/lsof-command-examples/ 12/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

COURSE
Linux Sysadmin CentOS 6 Course - Master the Tools, Configure it Right, and be Lazy

EBOOKS
Linux 101 Hacks 2nd Edition eBook - Practical Examples to Build a Strong Foundation in Linux Bash 101 Hacks eBook - Take Control of Your Bash Command Line and Shell Scripting Sed and Awk 101 Hacks eBook - Enhance Your UNIX / Linux Life with Sed and Awk Vim 101 Hacks eBook - Practical Examples for Becoming Fast and Productive in Vim Editor Nagios Core 3 eBook - Monitor Everything, Be Proactive, and Sleep Well

POPULAR POSTS
12 Amazing and Essential Linux Books To Enrich Your Brain and Library 50 UNIX / Linux Sysadmin Tutorials 50 Most Frequently Used UNIX / Linux Commands (With Examples) How To Be Productive and Get Things Done Using GTD 30 Things To Do When you are Bored and have a Computer Linux Directory Structure (File System Structure) Explained with Examples Linux Crontab: 15 Awesome Cron Job Examples Get a Grip on the Grep! 15 Practical Grep Command Examples Unix LS Command: 15 Practical Examples 15 Examples To Master Linux Command Line History Top 10 Open Source Bug Tracking System Vi and Vim Macro Tutorial: How To Record and Play Mommy, I found it! -- 15 Practical Linux Find Command Examples 15 Awesome Gmail Tips and Tricks 15 Awesome Google Search Tips and Tricks RAID 0, RAID 1, RAID 5, RAID 10 Explained with Diagrams Can You Top This? 15 Practical Linux Top Command Examples Top 5 Best System Monitoring Tools Top 5 Best Linux OS Distributions How To Monitor Remote Linux Host using Nagios 3.0
www.thegeekstuff.com/2012/08/lsof-command-examples/ 13/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Awk Introduction Tutorial 7 Awk Print Examples How to Backup Linux? 15 rsync Command Examples The Ultimate Wget Download Guide With 15 Awesome Examples Top 5 Best Linux Text Editors Packet Analyzer: 15 TCPDUMP Command Examples The Ultimate Bash Array Tutorial with 15 Examples 3 Steps to Perform SSH Login Without Password Using ssh-keygen & ssh-copy-id Unix Sed Tutorial: Advanced Sed Substitution Examples UNIX / Linux: 10 Netstat Command Examples The Ultimate Guide for Creating Strong Passwords 6 Steps to Secure Your Home Wireless Network Turbocharge PuTTY with 12 Powerful Add-Ons

CATEGORIES
Linux Vim Sed Awk Bash Nagios OpenSSH IPTables Apache MySQL Perl Google Ubuntu PostgreSQL Hello World C Programming C++ Programming DELL Oracle
www.thegeekstuff.com/2012/08/lsof-command-examples/ 14/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

VMware

About The Geek Stuff

My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux, database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about Ramesh Natarajan and the blog.

Support Us
Support this blog by purchasing one of my ebooks. Bash 101 Hacks eBook Sed and Awk 101 Hacks eBook Vim 101 Hacks eBook Nagios Core 3 eBook

Contact Us
Email Me : Use this Contact Form to get in touch me with your comments, questions or suggestions about this site. You can also simply drop me a line to say hello!. Follow us on Twitter
www.thegeekstuff.com/2012/08/lsof-command-examples/ 15/16

7/29/13

15 Linux lsof Command Examples (Identify Open Files)

Become a fan on Facebook Copyright 20082013 Ramesh Natarajan. All rights reserved | Terms of Service | Advertise

www.thegeekstuff.com/2012/08/lsof-command-examples/

16/16