The lsof Linux command is used to list open files. On Linux systems, everything is considered a file. This means that files, directories, sockets, pipes, devices, etc are all files, therefore the lsof command will list all of these things if any of them are in use.
Along with showing you what files are in use, it will give you detailed information about which user and process is using the file. As you can imagine, this can be pretty handy in a multitude of scenarios, such as when trying to figure out what connections are being made to your system or what processes are tying up a disk that you’re trying to unmount, etc.
In this guide, we’ll show you some of the most helpful examples of the lsof command to help you get the most out of it on your own system.
In this tutorial you will learn:
- How to use the lsof command with examples
|Requirements, Conventions or Software Version Used
|Any Linux distro
|Privileged access to your Linux system as root or via the
# – requires given linux commands to be executed with root privileges either directly as a root user or by use of
$ – requires given linux commands to be executed as a regular non-privileged user
How to use the lsof command
It’s easiest to learn about the lsof command through examples. To get started, use some of the following commands on your own system, and you’ll eventually have it mastered.
- The simplest use of the lsof command is to use it with no further options. This will list every file currently in use on your system, which is probably a lot. On our test system, which is a fresh install, there are well over 20,000 files in use.
- To see files that are opened by a particular user, you can add the
-uoption to your command.
# lsof -u linuxconfig
- To see all of the files opened by a particular process ID, use the
-poption. If you need to find the process ID first, you can use the ps command.
# lsof -p 1234
- Use the
-ioption to see a list of files that are related to network connections on your system. This is a good way to see listening ports and established connections.
# lsof -i
To see files for IPv4 specifically, use the following option:
# lsof -i4
Similarly, to see only IPv6 files:
# lsof -i6
- You can also use the
-ioption to check the files that are using specific ports. For example, the following command will check TCP port 80 and show what files it is using.
# lsof -i TCP:80
You can also check port ranges, such as the following example where we show which files are using TCP ports 20-100.
# lsof -i TCP:20-100
And you can also use UDP instead of TCP:
# lsof -i UDP:20-100
- To see which files are being used by a particular command, use the
-coption. In this example, we view all the files that being used by the ping command.
# lsof -c ping
- The lsof command uses the
^character to exclude certain results. For example, to list files that are not in use by user linuxconfig, we could use the following syntax.
# lsof -u^linuxconfig
In this guide, we saw how to use the lsof command on Linux through some of the most common and useful examples. Using the options we’ve covered should help you get the most out of the command, but there’s always more to check out in the manual pages if you’re interested.