The lsof utility - 'list open files'

What is it?

lsof is a powerful command line utility - its main function is to "list open files." It does this by displaying information about the file descriptor and the processes that have them open. It includes the ability to also show network connections and listening ports which can be filtered out based on various criteria. The information provided, i.e. (file descriptor, process ID, and process name) can be used to diagnose issues on a linux based systems such as identifying processes that may be holding open locks on a file.

Usage

Here are a few ways in which lsof may be used to troubleshoot and analyse open files on a Linux system:

Basic usage:

• Find all open files for a user:

# lsof -u <username>

• Find all open files associated with a particular process using a PID ID.

# lsof -p <PID>

• To list and locate all open socketfiles

# lsof +D / -a -d sock

• Locate all open files that are listening over a specific port.

# lsof -i :<port number>

• Identify all open files linked to an application that is being written to or read from.

# lsof -c <program name> -a -r <read/write>

Advanced Usage

• Display the process name, process ID, and file name for all open files, with a set time interval.

# lsof -n -r <time interval> +L -F pn -F f

• Locate all open files for a specific process (between set time interval) and sort them by process ID

# lsof -p <PID> -n -r <time interval> +L -s

• Find and show all open files, as well as the command line that opened them.

# lsof -c <command name> -a -c <command name> +L1

• Find all open files that are linked to a certain file descriptor.

# lsof -a -d <file descriptor>

Notes

Please keep in mind that lsof may require privilege elevation to run commands (open files that belong to other users), therefore sudo may be required before commands.