As we all know that everything in Linux OS  is consist of file( library files, pipes, socket, device and .etc). Lsof meaning that is knowing  as “list open file” which is used to view list open file on the system and these files are opened by which process .This tool is useful therefore sometimes we want to troubleshooting on system. For instance we want to delete any  device from system, sometimes give us error message as “Device is busy”. There can be several  reasons but firstly  we should check whether open files in this device? If is present then we closed all open files on this device after  that we can delete this device. Usually system administrators is using from this command. This utility is available every Linux distribution. Now, let’s look at examples.

  1. Look at all open file on system
[root@babak ~]# lsof | less


As we see that list all open files on the system. There many column is self explanatory. Let’s review FD and TYPE column more clearly

FD stand for ‘File Description’ and can be some of value  as follows

  • cwd – current working directory
  • txt – text file
  • mem – memory mapped file
  • rtd – root directory
  • mmap –memory mapped device
  • ltx – shared library file(code and data)
  • err – FD information error

Also you can see “number” values in FD column that means is describing file mode, can be in three mode:

  • r – for read
  • w – for write
  • u – for read and write

TYPE describing type of the file and can be some of value  as following section

  • CHR – for character special file
  • DIR – for directory
  • FIFO- First In First out
  • REG – regular file
  • IPv4 – for an ipv4 socket
  1. List open file for specified file ,for example we review ‘/var/log/messages’ file
[root@babak ~]# lsof /var/log/messages


  1. List open file for specified user

We log on demo user account and open test.txt file and write something into(keep file open). Then we open new session and log on  root user and write as following command and we will see opened file for demo user

[root@babak ~]# lsof -u demo


If we want to make sure  that don’t list open files particularly user from all users then you can use  ‘^’ options

 [root@babak ~]# lsof -u ^demo

Here, we list open files all users to exclude demo user

  1. List open files under directory
[root@babak ~]# lsof +D /etc/


  1. List open file for specified port number, for example 22 (ssh)

[root@babak ~]# lsof -i TCP:22

We also list all open file by process TCP port range from 1-1024

[root@babak ~]# lsof -i TCP:1-1024


If you want to look at all open files for  network connections

[root@babak ~]# lsof –i

List all network files in use by a specific process

[root@babak ~]# lsof -i -a -p 25
  1. List open files for specified process name via using ‘-c’ options of lsof command. Also we can make to search multiple process name in the single line
[root@babak ~]# lsof -c nfsd -c ssh


Also possible for specified process id (PID)

[root@babak ~]# lsof -p 2
  1. List PID of process which files opened by these process. For knowing this you would use ‘-t’ options

[root@babak ~]# lsof -t /var/log/messages



Sometimes we kill all process with regarding to particularly user, device, file. This time we can use below command

[root@babak ~]# kill -9 lsof -t -u demo

[root@babak ~]# lsof -u demo

[root@babak ~]#

If we want to look at again specified user then list open file nothing for specified

  1. List open files in use by NFS files
[root@babak ~]# lsof -N –a
  1. You can look at errors with related to opened files for examples I want to look accidentally deleted apache log files as follow
[root@babak ~]# lsof | grep -iE error_log

That’s all for this article, options of lsof command isn’t enough these if you get more information about this command then you can use man page of lsof command. I hope you will learn lsof command guide via this article.




Please enter your comment!
Please enter your name here