A Unix Utility You Should Know About: lsof January 10, 2011Posted by Tournas Dimitrios in Linux admin tools.
Lsof follows Unix philosophy closely. It does just one task and it does it perfectly — it lists information about files opened by processes. An open file may be a regular file, a directory, a NFS file, a block special file, a character special file, a shared library, a regular pipe, a named pipe, a symbolic link, a socket stream, an Internet socket, a UNIX domain socket, and many others. Since almost everything in Unix is a file, you can imagine how incredibly useful lsof is! lsof has a truly staggering number of options. You can use it to get information about devices on your system, what a given user is touching at any given point, or even what files or network connectivity a process is using. lsof replaces my need for both netstat and ps entirely. It has everthing I get from those tools and much, much more.
In this article I will try to present lsof based on as many use cases as I can think of. Let’s start with the simplest (that you probably already know) and proceed to more complicated ones.
|Practical examples of lsof|
|lsof||Running lsof without any arguments lists all open files by all processes.|
|lsof /path/to/file||With an argument of a path to a file, lsof lists all the processes, which are using the file in some way .You may also specify several files, which lists all the processes, which are using all the files (separate them with space)|
|lsof +D /usr/lib||With the +D argument lsof finds all files in the specified directory and all the subdirectories.|
|lsof -u user1
lsof -u user1,user2
lsof -u xyz -u root
|The -u option (think user) limits output of files opened only by user user1.
Separate them by comma or use multiple -u
|lsof | grep tmp
lsof -c tmp
|This will list all the open files by a processes whose starts with tmp.|
|lsof -c apache -c mysql||This will list all open files by apache and mysql.|
|lsof -u ^root||Notice the ^ character before root username. It negates the match and causes lsof print all open files by all users who are not root.|
|lsof -p 467,875,903
lsof -p ^187
|This selects processes with PIDs 467, 875 and 903 .
Exclude process 187
|lsof -i||Lsof with -i option lists all processes with open Internet sockets (TCP and UDP).|
|lsof -i tcp
lsof -i udp
|The udp | tcp option causes lsof to list processes with UDP | TCP sockets.|
|lsof -i :80||The :80 option to -i makes lsof find processes using TCP or UDP port 80.|
|lsof -i udp:53||Who ‘s using specific port and protocol|
|lsof -a -u user3 -i||Here the -a option combines -u and -i to produce listing of network file usage by user user3.|
|lsof -N||This option is easy to remember because -N is NFS.|