jump to navigation

A Unix Utility You Should Know About: lsof January 10, 2011

Posted by Tournas Dimitrios in Linux admin tools.

Lsof follows Unix philosophy closely. It does just one task and it does it perfectly — it lists information about files opened by processes. An open file may be a regular file, a directory, a NFS file, a block special file, a character special file, a shared library, a regular pipe, a named pipe, a symbolic link, a socket stream, an Internet socket, a UNIX domain socket, and many others. Since almost everything in Unix is a file, you can imagine how incredibly useful lsof is! lsof has a truly staggering number of options. You can use it to get information about devices on your system, what a given user is touching at any given point, or even what files or network connectivity a process is using. lsof replaces my need for both netstat and ps entirely. It has everthing I get from those tools and much, much more.

In this article I will try to present lsof based on as many use cases as I can think of. Let’s start with the simplest (that you probably already know) and proceed to more complicated ones.

Practical examples of   lsof
lsof Running lsof without any arguments lists all open files by all processes.
lsof /path/to/file With an argument of a path to a file, lsof lists all the processes, which are using the file in some way .You may also specify several files, which lists all the processes, which are using all the files (separate them with space)
lsof +D /usr/lib With the +D argument lsof finds all files in the specified directory and all the subdirectories.
lsof -u user1
lsof -u user1,user2
lsof -u xyz -u root
The -u option (think user) limits output of files opened only by user user1.
Separate them by comma or use multiple -u
lsof | grep tmp
lsof -c tmp 
This will list all the open files by a processes whose starts with tmp.
lsof -c apache -c mysql This will list all open files by apache and mysql.
lsof -u ^root Notice the  ^ character before root username. It negates the match and causes lsof print all open files by all users who are not root.
lsof -p 467,875,903
lsof -p ^187
This selects processes with PIDs 467, 875 and 903 .

Exclude process 187

lsof -i Lsof with -i option lists all processes with open Internet sockets (TCP and UDP).
lsof -i tcp
lsof -i udp
The udp | tcp option causes lsof to list processes with UDP | TCP sockets.
lsof -i :80 The :80 option to -i makes lsof find processes using TCP or UDP port 80.
lsof -i udp:53 Who ‘s using specific port and protocol
lsof -a -u user3 -i Here the -a option combines -u and -i to produce listing of network file usage by user user3.
lsof -N This option is easy to remember because -N is NFS.
This selects processes with PIDs 450, 980 and 333.


No comments yet — be the first.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s