lsof

What is lsof?

lsof is a versatile command-line utility that displays information about files opened by processes. This includes network connections, open files, and more. Understanding this information is critical for troubleshooting network issues, identifying resource bottlenecks, and generally gaining a deeper insight into your system’s activity. It’s a tool for system administrators, developers, and anyone seeking a detailed view of their Linux system’s file usage.

Basic Usage: Listing All Open Files

The simplest way to use lsof is to run it without any arguments:

lsof

This command will list all open files on your system. The output can be quite extensive, containing numerous columns with information such as:

• COMMAND: The name of the process.
• PID: The process ID.
• USER: The user running the process.
• FD: File descriptor (e.g., 0 for stdin, 1 for stdout, 2 for stderr).
• TYPE: The type of file (e.g., REG, DIR, SOCK).
• DEVICE: The device the file resides on.
• SIZE/OFF: The size of the file or offset within the file.
• NODE: The inode number.
• NAME: The name of the file.

Filtering with lsof: Targeting Specific Processes and Files

The true power of lsof lies in its filtering capabilities. Let’s look at some examples:

1. Listing open files for a specific process:

To see which files are opened by a specific process (identified by its PID), use the -p option:

lsof -p 12345

Replace 12345 with the actual PID of the process. You can find the PID using other commands like ps aux | grep <process_name>.

2. Listing files opened by a specific user:

To list files opened by a specific user, utilize the -u option:

lsof -u john

Replace john with the username.

3. Identifying files opened by a specific process and containing a specific string:

Combine filtering options for a more precise search. For instance, to find files opened by a process with PID 12345 that contain the string “config”:

lsof -p 12345 | grep "config"

4. Finding network connections:

lsof is also extremely useful for investigating network connections. This command lists all network connections:

lsof -i

This will show you listening ports, established connections, and more. You can further filter this: to find connections on a specific port (e.g., port 80):

lsof -i :80

5. Finding files opened by a specific command:

You can search for files opened by a particular command using -c option. For example, find all files open by the Firefox process:

lsof -c firefox

Beyond the Basics: Advanced lsof Options

lsof provides numerous other options for more granular control over the output. Refer to the man lsof page for a complete list and detailed explanations.

This exploration of lsof demonstrates its versatility in examining file usage and network connections within a Linux system. Its filtering capabilities let users pinpoint specific processes and files, making it an essential command for system administrators and developers alike.