Discover 15 essential lsof command examples for Linux administrators to monitor open files, troubleshoot issues, and manage system resources.
As a Linux administrator, DevOps engineer, or developer, mastering essential system commands is crucial for maintaining and troubleshooting Linux-based environments. One such powerful and often underutilized command is lsof (List Open Files). Since Linux treats everything as a file—whether it’s a regular file, a directory, a socket, or a network connection—having the ability to inspect open files is vital for system monitoring, debugging, and security auditing.
The lsof command allows users to view information about open files and the processes that are accessing them. This command proves invaluable when diagnosing issues like locked files, unauthorized file access, identifying which processes are using network ports, and resolving “Too many open files” errors. By understanding how to use lsof effectively, you can enhance your Linux troubleshooting skills, optimize system performance, and ensure security compliance.
In this article, we will explore 15 practical lsof command examples, covering a range of scenarios that every Linux administrator and developer should be familiar with. Whether you are a beginner looking to understand basic usage or an advanced user needing in-depth insights into process and file management, these examples will help you make the most out of the lsof command in your day-to-day Linux operations.
Installing LSOF on Linux
Before diving into the examples, ensure lsof is installed on your system:
On Oracle Linux 8/9 and Red Hat 8/9:
sudo yum install lsof -y
On Ubuntu 20.x and later:
sudo apt install lsof -y
Once installed, verify the installation by running:
lsof -v
1. List All Open Files
To list all open files on the system:
lsof
This displays every open file, including regular files, directories, sockets, and devices.
Real-Life Use Case:
- Use this command to get an overview of all open files on a server during a performance investigation.
2. Show Files Opened by a Specific User
To filter files opened by a specific user:
lsof -u username
Replace username with the name of the user you want to check.
Real-Life Use Case:
- Monitor the files accessed by a user to ensure compliance with usage policies or troubleshoot access issues.
3. Find Files Opened by a Specific Process
To identify files opened by a specific process ID (PID):
lsof -p <PID>
Replace <PID> with the process ID of interest.
Real-Life Use Case:
- Use this command when debugging a stuck or unresponsive process by examining the files it’s accessing.
4. List Open Files in a Specific Directory
To list files opened within a specific directory:
lsof +D /path/to/directory
Real-Life Use Case:
- Identify processes accessing files in critical directories like
/var/logor/tmp.
5. Find the Process Using a Specific Port
To determine which process is using a specific network port:
lsof -i :<port_number>
Replace <port_number> with the port you want to check.
Real-Life Use Case:
- Troubleshoot issues where a service fails to start due to port conflicts.
6. List All Network Connections
To display all open network connections:
lsof -i
Real-Life Use Case:
- Use this command to monitor network activity, including active connections and their associated processes.
7. Filter by Protocol (TCP/UDP)
To list only TCP or UDP connections:
lsof -i tcp
lsof -i udp
Real-Life Use Case:
- Check if specific services are actively using the desired protocol, such as HTTP (TCP).
8. List Files Opened by Root User
To filter files opened by the root user:
lsof -u root
Real-Life Use Case:
- Identify critical files accessed by system services or investigate potential security issues.
9. Monitor a File in Real Time
To monitor which processes are accessing a specific file in real time:
lsof /path/to/file
Real-Life Use Case:
- Troubleshoot issues with files being locked or heavily accessed, such as log files.
10. List All Open Files for a Specific Command
To find files opened by a specific command:
lsof -c <command_name>
Replace <command_name> with the name of the command (e.g., nginx, mysql).
Real-Life Use Case:
- Verify which files or sockets are being used by a specific service.
11. Find Deleted Files Still in Use
To locate deleted files that are still open by processes:
lsof | grep deleted
Real-Life Use Case:
- Recover disk space by identifying processes holding onto deleted files, especially in
/varor/tmp.
12. List Open Files for a Specific Device
To display files opened on a specific device, use:
lsof /dev/sda1
Real-Life Use Case:
- Diagnose high I/O usage or identify processes causing disk contention.
13. Kill Processes Accessing a File
To terminate processes accessing a specific file:
lsof /path/to/file
kill -9 <PID>
Real-Life Use Case:
- Resolve file lock issues by forcefully stopping the offending process.
14. Check NFS Mounts in Use
To find processes accessing Network File System (NFS) mounts:
lsof | grep nfs
Real-Life Use Case:
- Monitor NFS usage to troubleshoot latency or permission issues.
15. Display Open Files with File Descriptors
To see file descriptors associated with open files:
lsof -n -F
Real-Life Use Case:
- Understand file descriptor usage to optimize system performance or resolve “Too many open files” errors.
Alternatives to LSOF
While lsof is a powerful tool, here are some alternatives for specific scenarios:
1. ss Command
Useful for examining network connections, ss is faster and more efficient than lsof for network-related tasks:
ss -tuln
2. fuser Command
fuser identifies processes accessing a file or directory:
fuser /path/to/file
3. procfs Filesystem
For advanced users, /proc can provide detailed information about open files and processes:
ls -l /proc/<PID>/fd
Replace <PID> with the process ID.
Conclusion
The lsof command is a must-have tool in any Linux administrator’s arsenal. It provides deep insights into open files, active processes, network connections, and file system locks, making it essential for troubleshooting, security monitoring, and system optimization. Whether you’re tracking down which process is using a specific file, diagnosing performance issues, or managing system resources, lsof offers a quick and efficient way to gather crucial system data.
By mastering the 15 lsof command examples covered in this article, you can enhance your Linux expertise and confidently handle a variety of administrative and development tasks. Regularly using lsof will help you prevent resource bottlenecks, detect unauthorized access, and streamline your Linux workflow. With its versatility and ease of use, lsof remains a must-have tool in your Linux toolkit. Remember to explore alternatives like ss and fuser for specialized use cases.
If you found this guide useful, be sure to explore other essential Linux commands and best practices to keep your system running smoothly and securely. Happy troubleshooting!