Understanding the inner workings of a Linux system is crucial for system administrators and enthusiasts alike. The “lsof” command, short for “list open files,” is a powerful tool for monitoring and troubleshooting processes on a Linux system. It provides detailed information about files and processes that are currently open, facilitating a deeper understanding of system activities. In this article, we’ll explore 30 simple and effective lsof
commands, accompanied by command examples and detailed explanations of their output.
The Basic Syntax for top command in Linux:
The global syntax for the lsof
command in Linux is as follows:
lsof [options] [files or directories]
Here’s a breakdown of the components:
lsof
: The basic command to list open files and associated processes.[options]
: Optional flags or parameters that modify the behavior of the lsof
command. These options provide various filters and controls for the information displayed.[files or directories]
: Optional argument specifying the files or directories for which information is to be displayed. If no files or directories are provided, lsof
will list all open files on the system.This command provides a comprehensive list of all open files in the system. The output includes information such as the process ID (PID), file descriptor (FD), type of file (REG for regular file, DIR for directory), and the file path.
lsof
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 8,1 4096 2 /
init 1 root rtd DIR 8,1 4096 2 /
init 1 root txt REG 8,1 154176 178521 /sbin/init
...
In the output, you can see details such as the command name, process ID, user, file descriptor, file type, device, size/off (size or offset), node, and the file name or path.
Replace
with the process ID you’re interested in. This command narrows down the output to display only the open files associated with a specific process. It provides detailed information on the files, including their type, size, and the processes using them.
lsof -p PID>
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 12345 user cwd DIR 8,1 4096 1234567 /home/user
bash 12345 user rtd DIR 8,1 4096 1234567 /home/user
bash 12345 user txt REG 8,1 947660 987654 /bin/bash
...
The output provides details about open files associated with the specified process, including the file descriptor, file type, device, size/off, node, and file name or path.
Replace
with the desired username. This command filters the output to show only the files opened by a specific user. It’s useful for understanding the file activities of a particular user on the system.
lsof -u username>
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 12345 usmk cwd DIR 8,1 4096 1234567 /home/user
bash 12345 usmk rtd DIR 8,1 4096 1234567 /home/user
bash 12345 usmk txt REG 8,1 947660 987654 /bin/bash
...
The output shows files opened by processes owned by the specified user, including details about the command, process ID, file descriptor, file type, device, size/off, node, and file name or path.
By providing the path to a directory, this command shows a list of files opened within that directory. It’s beneficial for understanding which processes are interacting with files in a particular location.
lsof /path/to/directory
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 12345 user cwd DIR 8,1 4096 1234567 /path/to/directory
cat 23456 user 1w REG 8,1 23 9876543 /path/to/directory/example.txt
...
The output displays open files associated with processes operating within the specified directory.
This command lists all open network connections on the system. It provides information about the processes, protocol, local and remote addresses, and the state of each connection. It’s invaluable for network troubleshooting and understanding network-related activities on the system.
lsof -i
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1234 root 3u IPv4 123456 0t0 TCP *:22 (LISTEN)
sshd 1234 root 4u IPv6 123457 0t0 TCP *:22 (LISTEN)
nginx 5678 www-data 7u IPv4 987654 0t0 TCP 192.168.1.2:80->192.168.1.1:54321 (ESTABLISHED)
...
The output provides information about processes with open network connections, including the protocol, local and remote addresses, and connection state.
Replace
with the name of the command. This command filters the output to show files opened exclusively by processes running the specified command. It’s helpful for understanding which files a particular command is interacting with.
lsof -c command_name>
The output of this command will shows files opened by processes running the specified command, including details about the command, process ID, file descriptor, file type, device, size/off, node, and file name or path.
By combining the -u
and -c
options, you can narrow down the output to display files opened by a specific user and command. This is useful for pinpointing the files associated with a particular user executing a specific command.
lsof -u username> -c command_name>
Replace
with the process ID of the parent. This command displays files opened by the specified process and its child processes. It provides a hierarchical view of file interactions, which can be crucial for understanding the broader impact of a process.
lsof -g parent_pid>
Replace
with the desired port. This command helps identify processes that are using a specific network port. It’s essential for troubleshooting network-related issues and understanding which processes are communicating over a particular port.
lsof -i :port_number>
By combining the -u
and -g
options, you can filter the output to show files opened by a specific user and process group. This is beneficial for understanding the file activities of a particular user within a specific process group.
lsof -u username> -g process_group>
This command allows you to display files opened by processes whose command names match a partial string. It’s useful when you want to investigate the file interactions of processes with similar command names.
lsof -c partial_command_name>
When working in an environment that utilizes IPv6, this command focuses on listing open files associated with IPv6 network connections. It helps ensure visibility into processes using IPv6 addresses.
lsof -i6
The +D
option, followed by the directory path, lists files opened within the specified directory and its subdirectories. This is particularly useful for examining file activities in a specific directory hierarchy.
lsof +D /path/to/directory
By using the ^
symbol, you can exclude processes with a specific command from the results. This is beneficial when you want to focus on a user’s file interactions while excluding those related to a particular command.
lsof -u username> -c ^exclude_command>
Similar to command 8, this command displays files opened by the specified process and its descendant processes. The ^
symbol excludes processes with a specific parent PID from the results.
lsof -g ^parent_pid>
By combining the -c
and -a
options, along with specifying the user (-u
), this command shows files opened by processes with the specified name and arguments. It provides a more detailed view of processes with specific command attributes.
lsof -c command_name> -a -u
The -i
option with the ^
symbol allows you to exclude specific IP addresses from the results. This is useful when you want to focus on network connections while excluding those associated with certain IPs.
lsof -i -a -i ^excluded_ip>
This command specify both user and host to narrow down the results.
lsof -u username> -h hostname>
Combining the -c
and -d
options, this command displays files opened by processes with the specified name and executable path ending in “.txt”. It helps identify processes interacting with specific types of executable files.
lsof -c command_name> -a -d txt
Replace
with the desired network protocol (e.g., tcp, udp). This command filters the output to display network connections using a specific protocol, providing insights into processes utilizing that protocol.
lsof -i protocol>
The -A
option followed by the CPU number allows you to view files opened by processes running on a specific processor. This is particularly useful in environments where CPU affinity is configured.
lsof -A cpu_number>
Replace
with the desired file descriptor type (e.g., cwd, mem). This command filters the output to show only files opened with the specified types of file descriptors, providing insights into specific aspects of file interactions.
lsof -d file_descriptor_type>
The -s
option followed by the service name allows you to filter network connections based on services. This is particularly helpful for identifying processes associated with specific network services.
lsof -i -s service_name>
This command combines options to include specific user, process, and exclude a particular command. It provides a detailed view of file interactions for a user within a specific process while excluding a specific command.
lsof -u username> -c ^exclude_command> -p PID>
Specify the IP version (4 or 6) to filter results based on the version of the IP protocol. This command is helpful for distinguishing between IPv4 and IPv6 network connections.
lsof -i ip_version>
This command allows you to view files opened by processes running on the specified set of processors. It provides insights into file activities on specific CPU cores.
lsof -a -A cpu_list>
Combining the -F
and -b
options, this command displays files opened by processes using a specific file system type and associated with a particular device. It’s useful for analyzing file interactions on a specific storage device.
lsof -F file_system_type> -b device>
Replace
with the desired network connection state (e.g., LISTEN, ESTABLISHED). This command filters network connections based on their state, aiding in the identification of specific connection statuses.
lsof -i -s connection_state>
Combining the -a
and -r
options, this command filters the output to show files opened with specific access modes (e.g., r for read, w for write, x for execute). It helps identify processes with specific file access permissions.
lsof -a -r access_mode>
Combining the -F
and -b
options with the ^
symbol, this command displays files opened by processes using a specific file system type while excluding those associated with a particular device. It’s useful for focusing on file interactions on specific file system types, excluding unwanted devices.
lsof -F file_system_type> -b ^exclude_device>
The “lsof” command is an invaluable tool for system administrators, providing insights into the open files, network connections, and processes on a Linux system. By mastering these 40 simple and effective “lsof” commands, you can enhance your ability to troubleshoot issues, monitor system activity, and gain a deeper understanding of your system’s inner workings. Experiment with these commands in different scenarios to become proficient in leveraging “lsof” for efficient system analysis.
If you encounter any challenges or have questions regarding the “lsof” commands discussed in this article, feel free to drop a comment below. I’ll do my best to assist you and provide further clarification.
If you found this guide helpful and informative, don’t forget to give it a thumbs up! Your feedback is crucial, and it encourages the creation of more content to help you navigate the intricacies of Linux system administration.
Share this article with your peers and fellow Linux enthusiasts who might benefit from these “lsof” command insights. Spread the knowledge and contribute to building a community of skilled Linux users.
Stay tuned for more articles, tips, and tricks to enhance your Linux expertise. Happy exploring and mastering the world of “lsof” commands!
The post 31 Most Useful lsof Command in Linux (list Open Files) appeared first on Linux Tutorial Hub.
Welcome to the Ubuntu Weekly Newsletter, Issue 883 for the week of March 9 –…
In this article, we will see how to install nvidia-smi on Ubuntu or Debian Linux.…
In this article, we will see how to install clang tool on Ubuntu or Debian…
When working with Docker containers on Raspberry Pi devices, you might encounter frustrating signature verification…
You’ve recently upgraded to Ubuntu 18.04 and found that your OpenVPN connection no longer resolves…
Have you ever tried to open System Monitor on your Ubuntu 18.04 system only to…