Linux LSOF Command - Explained with Examples
- Linux LSOF Command - Explained with Examples
The lsof command stands for List Open Files and shows open files and which process uses them.
Also, Since Linux sees every object as a file, such as devices, directories, etc., unidentified open files prevent users from modifying them.
Here at LinuxAPT, we shall look into the usage of the LSOF command.
The general syntax of this command is given below:
$ lsof [option]
Here, you can replace "option" with any of the options that are available with this command.
Here, we will be using the LSOF command in Linux for simply listing down all of the open files with the below command:
Running this command without any options prints the details about all the currently opened files on the terminal.
In this example, we will use the LSOF command to print the details about all the open files belonging to a particular Linux user since a Linux system can have multiple users at the same time.
The below command will do the job:
$ lsof –u system
The LSOF command with the "-u" flag followed by the username prints all the open files belonging to the specified user.
Here, we wanted to print the open files belonging only to the Linux user named "system". You can replace it with the username of the user whose open files you wish to list down.
All the open files belonging to the specified user of our Linux system will be displayed.
In this example, we intend to print all the open files that are associated with a specific process ID.
The below command for instance when executed will do the job:
$ lsof –p 1129
Whenever the LSOF command is paired up with the "-p" flag followed by a particular process ID, then all the open files associated with that particular process ID are printed on the terminal.
You can replace "1129" with the process ID of the process whose associated open files you want to print.
All the open files associated with the specified process ID of our Linux system will be displayed.
Now, we simply want to list down all those open files that are associated with the parent processes in Linux. The below command will do the Job:
$ lsof –R
The "-R" flag is used with the LSOF command for listing all the open files associated only with the parent processes in Linux.
All the open files associated with the parent processes of our Linux system will be displayed.
In this case, we will list down all the open files associated with the network connections of Linux that follow a particular protocol such as TCP or UDP. The below LSOF command will be helpful:
$ sudo lsof –i tcp
This command requires "sudo" privileges to execute. Moreover, you can simply replace "tcp" with "udp" if you want to display all the open files associated with this particular protocol.
All the open files of our Linux system belonging to the specified protocol will be displayed.
This article covers the usage of the LSOF command in Linux. In fact, With lsof, you can find different processes locking up a file or directory, a process listening on a port, a user's process list, what all files a process is locking.
lsof isn't available by default on most Linux distributions but can be easily installed. So Use the below command to install lsof:
1. For CentOS / RHEL / Fedora, run the below command:
$ sudo yum install lsof
2. For CentOS/RHEL 8, you can use the DNF command:
$ sudo dnf install lsof
3. For Ubuntu / Debian, run the below command:
$ sudo apt install lsof
You can get a summarized list of lsof supported options using -? or -h flag:
$ lsof -?