15+ lsof command examples in Linux [Cheat Sheet] | GoLinuxCloud (2024)

Table of Contents
Introduction to lsof command Different examples to use lsof command 1. lsof command to list all open files 2. List files opened by specific user with lsof command 3. Exclude a specific user with lsof command 4. Avoid kernel functions with lsof command 5. lsof command to find files opened by specific process 6. Search for all open files of directory using lsof command 7. List all IPv4 and IPv6 connections with lsof command 8. List all TCP connections using lsof command 9. Hide host names from lsof command output 10. Display port numbers with lsof command output 11. lsof command to list open files by specific process ID 12. Exclude the open files of specific process using lsof command 13. List UNIX domain socket files with lsof command 14. lsof command to include PPID column 15. lsof command to list UID numbers 16. List terse output with lsof command 17. List all deleted files occupied by any process for a partition Conclusion What's Next Further Reading FAQs References

Topics we will cover hide

Introduction to lsof command

Different examples to use lsof command

1. lsof command to list all open files

2. List files opened by specific user with lsof command

3. Exclude a specific user with lsof command

4. Avoid kernel functions with lsof command

5. lsof command to find files opened by specific process

6. Search for all open files of directory using lsof command

7. List all IPv4 and IPv6 connections with lsof command

8. List all TCP connections using lsof command

9. Hide host names from lsof command output

11. lsof command to list open files by specific process ID

12. Exclude the open files of specific process using lsof command

13. List UNIX domain socket files with lsof command

14. lsof command to include PPID column

15. lsof command to list UID numbers

16. List terse output with lsof command

17. List all deleted files occupied by any process for a partition

Conclusion

What's Next

Further Reading

Introduction to lsof command

lsof means list open files, thus it provides a list of files that are opened by processes in the Linux system. It does not list only regular files. An open file can also be a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.)

Different examples to use lsof command

When lsof command is used without any option, it lists all open files belonging to all active processes. The basic syntax of lsof command is:

$ lsof [option] [names]

In this article, we will go through some of the lsof command examples in the Linux system.

ALSO READ10 elinks command examples in Linux [Cheat Sheet]

1. lsof command to list all open files

The lsof command displays all open files that are opened by processes in the system.

$ lsof

Sample Output:

ubuntu@golinux:~$ lsofCOMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 1 root cwd DIR 253,0 4096 2 /systemd 1 root rtd DIR 253,0 4096 2 /systemd 1 root txt REG 253,0 1620224 821084 /lib/systemd/systemdsystemd 1 root mem REG 253,0 1369352 820667 /lib/x86_64-linux-gnu/libm-2.31.sosystemd 1 root mem REG 253,0 178528 787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17systemd 1 root mem REG 253,0 1575112 260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0systemd 1 root mem REG 253,0 137584 820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0systemd 1 root mem REG 253,0 43312 788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1systemd 1 root mem REG 253,0 34872 272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0...

lsof displays the following information in the output.

  • COMMAND: It contains the first nine characters of the name of the UNIX command associated with the process.
  • PID: It is the Process IDentification number of the process.
  • USER: It contains the user ID number or login name of the user to whom the process belongs.
  • FD: It is the File Descriptor number of the file.
  • TYPE: It is the type of node associated with the file - e.g., GDIR, GREG, VDIR, VREG, etc.
  • DEVICE: It contains the device numbers, separated by commas, for a directory or NFS file, or 'memory' for memory file, etc.
  • SIZE, SIZE/OFF, or OFFSET: It is the size of the file or the file offset in bytes. A value is displayed in this column only if it is available.
  • NODE: It includes the node number of a local file, inode number of an NFS file, the Internet protocol type - e. g, ''TCP'', etc.
  • NAME: It containsthe name of the mount point and file system on which the file resides or the local and remote Internet addresses of a network file.
ALSO READAdvanced Package Mgmt with dpkg command [Cheat Sheet]
See Also
Using lsof Command in Linux with Examples

2. List files opened by specific user with lsof command

You can use -u option to specify users with login names or user ID. It helps to display all files opened by specified user.

$ lsof -u username

OR

$ lsof -u userID

Sample Output:

deepak@ubuntu:~$ lsof -u deepak | lessCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 2035 deepak cwd DIR 253,0 4096 2 /systemd 2035 deepak rtd DIR 253,0 4096 2 /systemd 2035 deepak txt REG 253,0 1620224 821084 /lib/systemd/systemdsystemd 2035 deepak mem REG 253,0 1369352 820667 /lib/x86_64-linux-gnu/libm-2.31.sosystemd 2035 deepak mem REG 253,0 178528 787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17systemd 2035 deepak mem REG 253,0 1575112 260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0systemd 2035 deepak mem REG 253,0 137584 820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0systemd 2035 deepak mem REG 253,0 43312 788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1systemd 2035 deepak mem REG 253,0 34872 272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0systemd 2035 deepak mem REG 253,0 432640 788554 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1systemd 2035 deepak mem REG 253,0 30936 805442 /lib/x86_64-linux-gnu/libuuid.so.1.3.0systemd 2035 deepak mem REG 253,0 18680 788340 /lib/x86_64-linux-gnu/libattr.so.1.1.0

You can also specify multiples users by comma-separated set - e.g., ''abe'', or ''548,root''.

3. Exclude a specific user with lsof command

To exclude a particular user when listing opened files, you can use ^ character in front of a username.

$ lsof -u ^user

Sample Output:

For example, to exclude a user 'deepak, you can use:

root@ubuntu:~# lsof -u ^deepak | lessCOMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 1 root cwd DIR 253,0 4096 2 /systemd 1 root rtd DIR 253,0 4096 2 /systemd 1 root txt REG 253,0 1620224 821084 /lib/systemd/systemdsystemd 1 root mem REG 253,0 1369352 820667 /lib/x86_64-linux-gnu/libm-2.31.sosystemd 1 root mem REG 253,0 178528 787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17systemd 1 root mem REG 253,0 1575112 260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0systemd 1 root mem REG 253,0 137584 820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0systemd 1 root mem REG 253,0 43312 788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1systemd 1 root mem REG 253,0 34872 272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0systemd 1 root mem REG 253,0 432640 788554 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1...

4. Avoid kernel functions with lsof command

-b option causes lsof to avoid kernel functions that might block - namely, lstat, readlink, and stat.

$ lsof -b

Sample Output:

ubuntu@golinux:~$ lsof -bCOMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 1 root cwd DIR 253,0 4096 2 /systemd 1 root rtd DIR 253,0 4096 2 /systemd 1 root txt REG 253,0 1620224 821084 /lib/systemd/systemdsystemd 1 root mem REG 253,0 1369352 820667 /lib/x86_64-linux-gnu/libm-2.31.sosystemd 1 root mem REG 253,0 178528 787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17systemd 1 root mem REG 253,0 1575112 260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0systemd 1 root mem REG 253,0 137584 820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0systemd 1 root mem REG 253,0 43312 788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1systemd 1 root mem REG 253,0 34872 272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0...

5. lsof command to find files opened by specific process

-c option helps to list the files opened by processes that start with specified characters.

$ lsof -c character

Sample Output:

The following commmand only displays the processes that start with net.

15+ lsof command examples in Linux [Cheat Sheet] | GoLinuxCloud (1)

6. Search for all open files of directory using lsof command

+D option tells lsof to search for all opened files in specified directory dir and all the files and directories it contains to its complete depth.

$ lsof +D dir

Sample Output:

15+ lsof command examples in Linux [Cheat Sheet] | GoLinuxCloud (2)

7. List all IPv4 and IPv6 connections with lsof command

Generally, -i option is used to list opened files by any of whose Internet address matches the specified address. If -i4 or -i6 is specified with no following address, only files of the indicated IP version, IPv4 or IPv6, are displayed.

IPv4:

$ lsof -i4

IPv6:

$ lsof -i6

Sample Output:

ubuntu@golinux:~$ lsof -i4COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEGeckoMain 3636 ubuntu 99u IPv4 64553 0t0 TCP 10.0.2.15:37570->239.237.117.34.bc.googleusercontent.com:https (ESTABLISHED)GeckoMain 3636 ubuntu 100u IPv4 64572 0t0 TCP 10.0.2.15:54270->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)GeckoMain 3636 ubuntu 107u IPv4 64907 0t0 TCP 10.0.2.15:52508->82.221.107.34.bc.googleusercontent.com:http (ESTABLISHED)GeckoMain 3636 ubuntu 109u IPv4 64944 0t0 TCP 10.0.2.15:54280->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)GeckoMain 3636 ubuntu 121u IPv4 65954 0t0 TCP 10.0.2.15:44478->133.247.244.35.bc.googleusercontent.com:https (ESTABLISHED)GeckoMain 3636 ubuntu 128u IPv4 64985 0t0 UDP localhost:47649->localhost:domain GeckoMain 3636 ubuntu 149u IPv4 65958 0t0 TCP 10.0.2.15:59234->ec2-35-82-131-108.us-west-2.compute.amazonaws.com:https (ESTABLISHED) ubuntu@golinux:~$ lsof -i6COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEGeckoMain 3636 ubuntu 97u IPv6 64541 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:59476->[2600:1901:0:38d7::]:http (ESTABLISHED)GeckoMain 3636 ubuntu 108u IPv6 64908 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:59488->[2600:1901:0:38d7::]:http (ESTABLISHED)GeckoMain 3636 ubuntu 114u IPv6 64921 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:59974->[2400:1a00:cd11:a112::67d3:9543]:http (ESTABLISHED)GeckoMain 3636 ubuntu 119u IPv6 66020 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:46360->bom12s16-in-x03.1e100.net:http (ESTABLISHED)GeckoMain 3636 ubuntu 142u IPv6 65406 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:49826->text-lb.eqsin.wikimedia.org:https (ESTABLISHED)

An Internet address can be specified in the form:

[46][protocol][@hostname|hostaddr][:service|port]

Here,

  • 46: It specifies the IP version, IPv4 or IPv6.
  • protocol: - A protocol name - TCP, UDP.
  • hostname: - an Internet host name.
  • hostaddr: A numeric Internet address.
  • service: /etc/services name - e.g., smtp - or a list of them.
  • port: port number, or a list of them.
ALSO READ25 ps command examples in Linux [Cheat Sheet]

8. List all TCP connections using lsof command

You can view the files that are used by TCP with -i option.

$ lsof -i TCP

Sample Output:

ubuntu@golinux:~$ lsof -i TCPCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEGeckoMain 3636 ubuntu 52u IPv4 68529 0t0 TCP 10.0.2.15:54328->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)GeckoMain 3636 ubuntu 97u IPv6 64541 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:59476->[2600:1901:0:38d7::]:http (ESTABLISHED)GeckoMain 3636 ubuntu 99u IPv4 64553 0t0 TCP 10.0.2.15:37570->239.237.117.34.bc.googleusercontent.com:https (ESTABLISHED)GeckoMain 3636 ubuntu 100u IPv4 64572 0t0 TCP 10.0.2.15:54270->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)GeckoMain 3636 ubuntu 107u IPv4 64907 0t0 TCP 10.0.2.15:52508->82.221.107.34.bc.googleusercontent.com:http (ESTABLISHED)GeckoMain 3636 ubuntu 108u IPv6 64908 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:59488->[2600:1901:0:38d7::]:http (ESTABLISHED)GeckoMain 3636 ubuntu 109u IPv4 64944 0t0 TCP 10.0.2.15:54280->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)GeckoMain 3636 ubuntu 114u IPv6 64921 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:59974->[2400:1a00:cd11:a112::67d3:9543]:http (ESTABLISHED)GeckoMain 3636 ubuntu 115u IPv4 68516 0t0 TCP 10.0.2.15:58622->ec2-44-226-241-1.us-west-2.compute.amazonaws.com:https (ESTABLISHED)GeckoMain 3636 ubuntu 117u IPv4 68504 0t0 TCP 10.0.2.15:47994->117.18.237.29:http (ESTABLISHED)GeckoMain 3636 ubuntu 119u IPv6 66020 0t0 TCP 2400-1A00-B050-ip6.wlink.com.np:46360->bom12s16-in-x03.1e100.net:http (ESTABLISHED)GeckoMain 3636 ubuntu 121u IPv4 65954 0t0 TCP 10.0.2.15:44478->133.247.244.35.bc.googleusercontent.com:https (ESTABLISHED)...

9. Hide host names from lsof command output

When viewing the network and internet files, -n option can be used to hide the host names in the output.

$ lsof -n -i4

Sample Output:

ubuntu@golinux:~$ lsof -n -i4COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEGeckoMain 3275 ubuntu 90u IPv4 117174 0t0 TCP 10.0.2.15:37668->34.117.237.239:https (ESTABLISHED)GeckoMain 3275 ubuntu 91u IPv4 117189 0t0 TCP 10.0.2.15:46280->13.227.138.71:https (ESTABLISHED)GeckoMain 3275 ubuntu 95u IPv4 117982 0t0 TCP 10.0.2.15:42732->52.88.17.115:https (SYN_SENT)GeckoMain 3275 ubuntu 105u IPv4 117501 0t0 TCP 10.0.2.15:53968->34.107.221.82:http (ESTABLISHED)GeckoMain 3275 ubuntu 110u IPv4 117543 0t0 UDP 127.0.0.1:52285->127.0.0.53:domain GeckoMain 3275 ubuntu 121u IPv4 117983 0t0 TCP 10.0.2.15:42734->52.88.17.115:https (SYN_SENT)GeckoMain 3275 ubuntu 129u IPv4 117980 0t0 TCP 10.0.2.15:56810->117.18.237.29:http (ESTABLISHED)GeckoMain 3275 ubuntu 130u IPv4 117967 0t0 TCP 10.0.2.15:53100->34.216.162.26:https (ESTABLISHED)GeckoMain 3275 ubuntu 139u IPv4 117972 0t0 TCP 10.0.2.15:53102->34.216.162.26:https (ESTABLISHED)
ALSO READ10+ rpmbuild command examples in Linux [Cheat Sheet]

10. Display port numbers with lsof command output

-P option displays the port numbers instead of port names for network files. It may make lsof run a little faster.

$ lsof -P -i4

Sample Output:

ubuntu@golinux:~$ lsof -P -i4COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEGeckoMain 3275 ubuntu 57u IPv4 188142 0t0 TCP golinux:54098->82.221.107.34.bc.googleusercontent.com:80 (ESTABLISHED)GeckoMain 3275 ubuntu 93u IPv4 189498 0t0 TCP golinux:58886->133.247.244.35.bc.googleusercontent.com:443 (ESTABLISHED)GeckoMain 3275 ubuntu 108u IPv4 188292 0t0 TCP golinux:50210->ec2-44-229-115-174.us-west-2.compute.amazonaws.com:443 (ESTABLISHED)

11. lsof command to list open files by specific process ID

-p option helps to display the opened files by processes whose process IDs are specified.

$ lsof -p pid

Sample Output:

For example, if pid is 3759, it displays only the files opened by process ID 3759.

ubuntu@golinux:~$ lsof -p 3759COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEWebExtens 3759 ubuntu cwd DIR 0,22 0 64943 /proc/3760/fdinfo (deleted)WebExtens 3759 ubuntu rtd DIR 0,22 0 64943 /proc/3760/fdinfo (deleted)WebExtens 3759 ubuntu txt REG 8,5 753048 477719 /usr/lib/firefox/firefoxWebExtens 3759 ubuntu DEL REG 0,1 44 /memfd:mozilla-ipcWebExtens 3759 ubuntu mem REG 8,5 829712 477725 /usr/lib/firefox/libfreeblpriv3.soWebExtens 3759 ubuntu mem REG 8,5 325960 477829 /usr/lib/firefox/libsoftokn3.soWebExtens 3759 ubuntu mem REG 8,5 275437 477711 /usr/lib/firefox/browser/features/webcompat@mozilla.org.xpiWebExtens 3759 ubuntu mem REG 8,5 319530 477709 /usr/lib/firefox/browser/features/screenshots@mozilla.org.xpiWebExtens 3759 ubuntu mem REG 8,5 15666 422343 /home/ubuntu/.mozilla/firefox/1d5bir3b.default-release/features/{d226935f-d14d-4e1a-aa04-b84f8de3ca43}/reset-search-defaults@mozilla.com.xpi...

12. Exclude the open files of specific process using lsof command

'^' (negation) also excludes the specified process ID. To exclude the opened files of the specific process, you can use -p option followed by ^PID.

$ lsof -p ^PID

Sample Output:

To exclude the processes with process ID 1321, you can use:

ubuntu@golinux:~$ lsof -p ^1321COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEgsd-datet 1318 1421 dconf\x20 ubuntu 1u unix 0x0000000000000000 0t0 30512 type=STREAMgsd-datet 1318 1421 dconf\x20 ubuntu 2u unix 0x0000000000000000 0t0 30512 type=STREAMgsd-datet 1318 1421 dconf\x20 ubuntu 3u a_inode 0,13 0 12388 [eventfd]gsd-datet 1318 1421 dconf\x20 ubuntu 4u a_inode 0,13 0 12388 [eventfd]gsd-datet 1318 1421 dconf\x20 ubuntu 5u unix 0x0000000000000000 0t0 30850 type=STREAMgsd-datet 1318 1421 dconf\x20 ubuntu 6u a_inode 0,13 0 12388 [eventfd]gsd-datet 1318 1421 dconf\x20 ubuntu 7u a_inode 0,13 0 12388 [eventfd]gsd-keybo 1324 ubuntu cwd DIR 8,5 4096 417131 /home/ubuntugsd-keybo 1324 ubuntu rtd DIR 8,5 4096 2 /gsd-keybo 1324 ubuntu txt REG 8,5 39760 407779 /usr/libexec/gsd-keyboardgsd-keybo 1324 ubuntu mem REG 8,5 182344 407440 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.8...
ALSO READ50+ tmux cheat sheet and shortcut commands

13. List UNIX domain socket files with lsof command

-U option selects the listing of UNIX domain socket files.

$ lsof -U

Sample Output:

ubuntu@golinux:~$ lsof -UCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 928 ubuntu 1u unix 0x0000000000000000 0t0 27571 type=STREAMsystemd 928 ubuntu 2u unix 0x0000000000000000 0t0 27571 type=STREAMsystemd 928 ubuntu 3u unix 0x0000000000000000 0t0 27598 type=DGRAMsystemd 928 ubuntu 16u unix 0x0000000000000000 0t0 27605 /run/user/1000/systemd/notify type=DGRAMsystemd 928 ubuntu 17u unix 0x0000000000000000 0t0 27606 type=DGRAMsystemd 928 ubuntu 18u unix 0x0000000000000000 0t0 27607 type=DGRAMsystemd 928 ubuntu 19u unix 0x0000000000000000 0t0 27608 /run/user/1000/systemd/private type=STREAMsystemd 928 ubuntu 20u unix 0x0000000000000000 0t0 27609 type=STREAMsystemd 928 ubuntu 26u unix 0x0000000000000000 0t0 27617 /run/user/1000/bus type=STREAMsystemd 928 ubuntu 27u unix 0x0000000000000000 0t0 27618 /run/user/1000/gnupg/S.dirmngr type=STREAM...

14. lsof command to include PPID column

-R option directs lsof command to list the Parent Process IDentification number in the PPID column.

$ lsof -R

Sample Output:

ubuntu@golinux:~$ lsof -R -u rootCOMMAND PID TID PPID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 1 0 root cwd DIR 253,0 4096 2 /systemd 1 0 root rtd DIR 253,0 4096 2 /systemd 1 0 root txt REG 253,0 1620224 821084 /lib/systemd/systemdsystemd 1 0 root mem REG 253,0 1369352 820667 /lib/x86_64-linux-gnu/libm-2.31.sosystemd 1 0 root mem REG 253,0 178528 787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17systemd 1 0 root mem REG 253,0 1575112 260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0systemd 1 0 root mem REG 253,0 137584 820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0systemd 1 0 root mem REG 253,0 43312 788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1systemd 1 0 root mem REG 253,0 34872 272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0...

15. lsof command to list UID numbers

You can use -l option to list UID numbers of users instead of their login names.

$ lsof -l

Sample Output:

ALSO READ6 practical scenarios to use grep recursive with examples

As you can see the user ID of deepak, 1000 is listed instead of the name.

ubuntu@golinux:~$ lsof -l -u deepakCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 2035 1000 cwd DIR 253,0 4096 2 /systemd 2035 1000 rtd DIR 253,0 4096 2 /systemd 2035 1000 txt REG 253,0 1620224 821084 /lib/systemd/systemdsystemd 2035 1000 mem REG 253,0 1369352 820667 /lib/x86_64-linux-gnu/libm-2.31.sosystemd 2035 1000 mem REG 253,0 178528 787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17systemd 2035 1000 mem REG 253,0 1575112 260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0systemd 2035 1000 mem REG 253,0 137584 820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0systemd 2035 1000 mem REG 253,0 43312 788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1systemd 2035 1000 mem REG 253,0 34872 272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0...

16. List terse output with lsof command

-t option tells lsof to produce terse output with process identifiers only and no header.

$ lsof -t

Sample Output:

ubuntu@golinux:~$ lsof -t901908910916918921924...

17. List all deleted files occupied by any process for a partition

We can use +aL1 <file_system> to list unlinked open files on the specified file system. For example here we we can see, there are multiple unlinked files which are still occupied by PID 31261.

# lsof +aL1 /varCOMMAND PID USER FD TYPE DEVICE SIZE NLINK NODE NAMErhn_check 31261 root 8u REG 253,2 22082560 0 327733 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/primary.xml.gz.sqlite (deleted)rhn_check 31261 root 9u REG 253,2 78848 0 327737 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/primary.xml.gz.sqlite (deleted)rhn_check 31261 root 10u REG 253,2 144384 0 327741 /var/cache/yum/prod-03-mssb-x86_64-server-5/primary.xml.gz.sqlite (deleted)rhn_check 31261 root 11u REG 253,2 54056960 0 327748 /var/cache/yum/prod-03-rhel-x86_64-server-5/primary.xml.gz.sqlite (deleted)rhn_check 31261 root 12u REG 253,2 9275392 0 327752 /var/cache/yum/prod-03-rhel-x86_64-server-supplementary-5/primary.xml.gz.sqlite (deleted)rhn_check 31261 root 13u REG 253,2 582656 0 327756 /var/cache/yum/prod-03-rhn-tools-rhel-x86_64-server-5-rhel5/primary.xml.gz.sqlite (deleted)rhn_check 31261 root 14u REG 253,2 34002944 0 327758 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/filelists.xml.gz.sqlite (deleted)rhn_check 31261 root 15u REG 253,2 33857536 0 327760 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/other.xml.gz.sqlite (deleted)rhn_check 31261 root 16u REG 253,2 23552 0 327762 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/filelists.xml.gz.sqlite (deleted)rhn_check 31261 root 17u REG 253,2 6144 0 327765 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/other.xml.gz.sqlite (deleted)rhn_check 31261 root 18u REG 253,2 98304 0 327767 /var/cache/yum/prod-03-mssb-x86_64-server-5/filelists.xml.gz.sqlite (deleted)rhn_check 31261 root 19u REG 253,2 68608 0 327769 /var/cache/yum/prod-03-mssb-x86_64-server-5/other.xml.gz.sqlite (deleted)rhn_check 31261 root 20u REG 253,2 227818496 0 327772 /var/cache/yum/prod-03-rhel-x86_64-server-5/filelists.xml.gz.sqlite (deleted)rhn_check 31261 root 21uw REG 253,2 489109504 0 327774 /var/cache/yum/prod-03-rhel-x86_64-server-5/other.xml.gz.sqlite (deleted)rhn_check 31261 root 22r REG 253,2 135095452 0 327773 /var/cache/yum/prod-03-rhel-x86_64-server-5/other.xml.gz (deleted)
ALSO READ10+ swapon command examples in Linux [Cheat Sheet]

Conclusion

lsof is a useful command when you want to know the files that are being used by processes in the system. We hope you have learned to use lsof command from this article. If you still have any confusion, please let us know in the comment section.

What's Next

20 sar command examples in Linux [Cheat Sheet]

Further Reading

man page for lsof command

Views: 113

Rohan Timalsina

He is proficient in a wide range of skills, including Page Builder Plugins such as Elementor, Beaver Builder, Visual Composer, and Divi Builder. His expertise extends to Front End Development with HTML5/CSS3, JavaScript, Bootstrap, and React.js. You can reach out to him on LinkedIn or check his projects on GitHub page.

15+ lsof command examples in Linux [Cheat Sheet] | GoLinuxCloud (2024)

FAQs

How to use lsof command in Linux? ›

It can be used with the syntax, lsof [option] [action or filepath] . In this example, we use the 'lsof' command followed by the path to a file. This command lists all processes that have opened the specified file.

Explore More ›
How to check open files in Linux without lsof? ›

Still, you need to be root. ls -l /proc/*/fd to see all open files like lsof does by default.

See More ›
What is the lsof output command? ›

lsof Command Options
OptionDescription
-u ^[username]Prints all files opened by everyone except a specific user.
-c [process]Lists all files accessed by a particular process.
-p [process ID]Shows all open files associated with a specific process ID.
-p ^[process ID]Shows files opened by all other PIDs.
17 more rows
Aug 4, 2022

Learn More Now ›
What is the purpose of lsof? ›

lsof : This is the command itself, standing for “List Open Files.” It is the primary command used to gather information about open files and processes on a Linux system. [options] : This part of the syntax refers to the various options or flags that can be added to the lsof command to customize its behavior.

Get More Info Here ›
How to check port with lsof? ›

To check the listening ports and applications with lsof :
  1. Open a shell prompt. For more information, see Opening a command or shell prompt (1003892).
  2. In the shell prompt window, run this command: lsof -i -P -n. You see output similar to: [root@server]# lsof -i -P -n. COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME.
Mar 20, 2024

Read The Full Story ›
How to find deleted files in Linux using lsof? ›

Even if a file has been deleted from the filesystem, a copy of the data is still present: Step 1. To determine where to go, obtain the process id and file descriptor of the process that has the file open by using lsof. Once you've obtained that information from lsof, copy the data from /proc.

Learn More ›
How to find list of open files in Linux? ›

The lsof command stands for List Open Files and shows open files and which process uses them. In Linux, everything is in the form of files.

View More ›
How do you check if a file is being read in Linux? ›

The command lsof -t filename shows the IDs of all processes that have the particular file opened. lsof -t filename | wc -w gives you the number of processes currently accessing the file. I would recommend wc -l instead of wc -w which works in more cases and lsof is not going to put more than one filename per line.

Read On ›
How to check how many files are opened in Linux? ›

The lsof command lists information about open files for running processes on the system. When we run lsof without any arguments, it displays the open files of every process running on the system.

Show Me More ›
What is the return code for lsof? ›

Lsof returns a one (1) if any error was detected, including the failure to locate command names, file names, Internet addresses or files, login names, NFS files, PIDs, PGIDs, or UIDs it was asked to list. If the -V option is specified, lsof will indicate the search items it failed to list.

See Details ›

What does lsof check running processes? ›

Using the lsof -p <processID> command, the files opened by a particular process can be checked. With that, we can check if we have a more accurate number of open files for that process.

Know More ›
What is the lsof package in Linux? ›

What is Linux lsof? To monitor and analyze your Linux system, lsof is an easy-to-use tool. The program, developed and published in 1994 by Vic Abell, is open source and is part of the standard installation for numerous Linux distributions, such as Debian or Ubuntu. lsof stands for “List open files”.

View Details ›
What is the lsof command for open files? ›

The lsof command is an acronym for "list open files," but its potential isn't limited to just that role. It's commonly said that in Linux, everything is a file. In many ways, that's true, so a utility that lists open files is actually pretty useful.

Read On ›
What is the lsof +L1 command in Linux? ›

The "+L1" option instructs lsof to display files with a size greater than or equal to 1 byte. This ensures that we only get relevant results. The output of this command will list all the open files on the system. However, we are only interested in files associated with disk space usage.

Keep Reading ›
What is tid in lsof? ›

The lsof output's default columns are: COMMAND: Refers to the command connected to the application that opened the file. PID: The file's working process's process identification number. TID: Indicates a task id for the related process.

Learn More Now ›
How to check if the 8080 port is used in Linux? ›

Linux:
  1. Open a Terminal: Use a terminal application such as GNOME Terminal, Konsole, or xterm.
  2. In the terminal, enter the following command: sudo lsof -i :8080 .
  3. Look for the line with the local address *:8080 in the output.
  4. Note the PID associated with that line.
Jul 17, 2023

Learn More ›
How to track a file using Linux command? ›

Syntax of Find Command in Linux :
  1. path: Starting directory for the search. Example: find /path/to/search.
  2. options: Additional settings or conditions for the search. Example: find /path/to/search -type f -name "*.txt"
  3. expression: Criteria for filtering and locating files. Example: find /path/to/search -type d -name "docs"
Jul 5, 2024

Continue Reading ›
How to check running process in Linux? ›

The 'ps' command displays information about running processes. To list all running processes, you can use the following command: ps -A or ps -e Both commands will provide you with a list of currently running processes along with their relevant details, such as process ID (PID), terminal, CPU usage, and more.

Learn More ›
How to use Jstat command in Linux? ›

How to launch jstat?
  1. -gc: garbage collection related statistics will be printed.
  2. -t timestamp since JVM was started will be printed.
  3. 11656: target JVM process Id.
  4. 10000: statistics will be printed every 10,000 milliseconds (i.e. 10 seconds).
  5. 30: statistics will be printed for 30 iterations.
Nov 18, 2019

Find Out More ›

References

Top Articles
Savannah Georgia Must-See Spots for First-Time Visitors
Best Places to Travel in 2024
Cecil Burton Funeral Home | Shelby, North Carolina
Abga Gestation Calculator
Friscolawnmowing
Temu Beanies
Teamsideline Manatee
Love In The Air Ep 2 Eng Sub
Craigslist Furniture By Owner Dallas
Magma Lozenge Location
Pepsi Collaboration
Email Hosting » Affordable Mail Solution with Personal Domain | IONOS
Spacebar Counter - Space Bar Clicker Test
Nissan 300Zx For Sale Craigslist
Ticket To Paradise Showtimes Near Cmx Daytona 12
What retirement account is tax-free?
The Goddess Collection
Netflix Phone Number: Live Human Help - Netflix - Claimyr
Top Football Recruits 2017
1800Comcast
What Times What Equals 82
Wayne State Dean's List
Andrew Davis Vsim
.Au Domain Godaddy
2503 South Tacoma Way
Winzige Tyrannen: So klein begann das Leben der Tyrannosaurier
Dawat Restaurant Novi
Gina's Pizza Port Charlotte Fl
Python Regex Space
Anon Rotten Tomatoes
The Eye Doctors North Topeka
Hope for recovery emerges for a Ukrainian soldier who suffered a severe brain injury 2 years ago
Kickflip Seeds
Daggett Funeral Home Barryton Michigan
Eros Cherry Hill
Alexandria Van Starrenburg
Cnb Pittsburg Ks
Look Who Got Busted New Braunfels
Dawson Myers Fairview Nc
SYSTEMAX Software Development - PaintTool SAI
Weather Radar Jamestown
DePaul joins nationwide pro-Palestinian college protests as encampment continues at University of Chicago
Grayson County Craigslist
Swrj Mugshots Logan Wv
Hourly Weather Forecast for Amsterdam, North Holland, Netherlands - The Weather Channel | Weather.com
Fired Dies Cancer Fired Qvc Hosts
Ticketmaster Lion King Chicago
Mama Mia Israel Soldier Original
Gym Membership & Workout Classes in Lafayette IN | VASA Fitness
Kingsport Weather Channel
Culver's Flavor Of The Day Wilson Nc
Raleigh Craigs List
Latest Posts
Arizona | Geography, Facts, Map, & History
The Ultimate Guide To Savannah, Georgia | We Are Travel Girls
Article information

Author: Ouida Strosin DO

Last Updated:

Views: 6128

Rating: 4.6 / 5 (56 voted)

Reviews: 87% of readers found this page helpful

Author information

Name: Ouida Strosin DO

Birthday: 1995-04-27

Address: Suite 927 930 Kilback Radial, Candidaville, TN 87795

Phone: +8561498978366

Job: Legacy Manufacturing Specialist

Hobby: Singing, Mountain biking, Water sports, Water sports, Taxidermy, Polo, Pet

Introduction: My name is Ouida Strosin DO, I am a precious, combative, spotless, modern, spotless, beautiful, precious person who loves writing and wants to share my knowledge and understanding with you.