Guide to lsof Linux command with examples

The lsof Linux command is used to list open files. On Linux systems, everything is considered a file. This means that files, directories, sockets, pipes, devices, etc are all files, therefore the lsof command will list all of these things if any of them are in use.

Along with showing you what files are in use, it will give you detailed information about which user and process is using the file. As you can imagine, this can be pretty handy in a multitude of scenarios, such as when trying to figure out what connections are being made to your system or what processes are tying up a disk that you’re trying to unmount, etc.

In this guide, we’ll show you some of the most helpful examples of the lsof command to help you get the most out of it on your own system.

In this tutorial you will learn:

How to use the lsof command with examples

lsof command on Linux

Software Requirements and Linux Command Line Conventions
Category	Requirements, Conventions or Software Version Used
System	Any Linux distro
Software	lsof
Other	Privileged access to your Linux system as root or via the `sudo` command.
Conventions	# – requires given linux commands to be executed with root privileges either directly as a root user or by use of `sudo` command $ – requires given linux commands to be executed as a regular non-privileged user

How to use the lsof command

It’s easiest to learn about the lsof command through examples. To get started, use some of the following commands on your own system, and you’ll eventually have it mastered.

The simplest use of the lsof command is to use it with no further options. This will list every file currently in use on your system, which is probably a lot. On our test system, which is a fresh install, there are well over 20,000 files in use.
```
# lsof
```

The most basic lsof command, which shows every file in use on the system

To see files that are opened by a particular user, you can add the -u option to your command.
```
# lsof -u linuxconfig
```
To see all of the files opened by a particular process ID, use the -p option. If you need to find the process ID first, you can use the ps command.
```
# lsof -p 1234
```

Showing all the files opened by process id 1234

Use the -i option to see a list of files that are related to network connections on your system. This is a good way to see listening ports and established connections.
```
# lsof -i
```
To see files for IPv4 specifically, use the following option:
```
# lsof -i4
```
Similarly, to see only IPv6 files:
```
# lsof -i6
```
You can also use the -i option to check the files that are using specific ports. For example, the following command will check TCP port 80 and show what files it is using.
```
# lsof -i TCP:80
```
You can also check port ranges, such as the following example where we show which files are using TCP ports 20-100.
```
# lsof -i TCP:20-100
```
And you can also use UDP instead of TCP:
```
# lsof -i UDP:20-100
```
To see which files are being used by a particular command, use the -c option. In this example, we view all the files that being used by the ping command.
```
# lsof -c ping
```

Showing all files opened by the ping command

The lsof command uses the ^ character to exclude certain results. For example, to list files that are not in use by user linuxconfig, we could use the following syntax.
```
# lsof -u^linuxconfig
```

Closing Thoughts

In this guide, we saw how to use the lsof command on Linux through some of the most common and useful examples. Using the options we’ve covered should help you get the most out of the command, but there’s always more to check out in the manual pages if you’re interested.

How to use the lsof command

Closing Thoughts

Related Linux Tutorials: