lsof Command Examples in Linux
The lsof command prints a list of all files that are currently opened to all active processes. This can include everything from a text file to a device file—any object that the system can parse as a file. You may be prevented from modifying a file if it is opened in another process. By using lsof you can identify the offending process for termination. You can also use lsof to analyze how a process uses files, which can be helpful in identifying malicious processes or processes that have unwanted side effects.
The lsof command prints each file opened by a process on its own line. It prints information such as:
- The name of the command/process.
- The PID.
- The invoking user.
- The file descriptor (FD), including what permissions the file is open with.
- The type of file.
- The name of the file.
Syntax
The syntax of the lsof command is:
$ lsof [options]
Listing all processes that have the home directory open.
lsof Command Examples
1. To list all the open files:
# lsof
2. To get the lsof help:
# lsof -h
# lsof --help
# lsof -?
3. To list files for processes starting with specified character:
# lsof -c s
4. To avoid kernel functions:
# lsof -b
5. To disable the reporting of any path name components:
# lsof -C
6. To search for all open instances of directory s:
# lsof +d s
7. To list of file descriptors (FDs) to exclude from or include in the output:
# lsof -d s
8. To to search for all open instances of directory D and all the files and directories it contains to its complete depth:
# lsof +D D
9. To directs lsof’s use of the device cache file:
# lsof -D D
10. To specifies a character list:
# lsof -F f
11. To selects the listing of files for the processes whose optional process group IDentification (PGID) numbers are in the comma-separated set:
# lsof -g s
12. To the listing of files any of whose Internet address matches the address specified in i:
# lsof -i i
13. To specifies a kernel name list file:
# lsof -k k
14. To conversion of user ID numbers to login names:
# lsof -l
15. To enables (+) or disables (-) the listing of file link counts:
# lsof -L l
# lsof +L l
16. To specifies an alternate kernel memory file or activates mount table supplement processing:
# lsof -m m
# lsof +m m
17. To Enables (+) or disables (-) the reporting of portmapper registrations:
# lsof -M
# lsof +M
18. To inhibits the conversion of network numbers to host names for network files:
# lsof -n
19. To selects the listing of NFS files:
# lsof -n
20. To display file offset at all times:
# lsof -o
21. To define the number of decimal digits (o) to be printed after the ââ0tââ for:
# lsof -o o
22. To directs lsof to bypass the strategy it uses to avoid being blocked by some kernel operations:
# lsof -O
23. To excludes or selects the listing of files for the processes:
# lsof -p s
24. To option inhibits the conversion of port numbers to port names for network files:
# lsof -P
25. To puts lsof in repeat mode:
# lsof +r
# lsof -r
26. To directs lsof to display file size at all times:
# lsof -s
27. To controls the reporting of some TCP/TPI information:
# lsof -T
28. To specifies that lsof should produce terse output with process identifiers:
# lsof -t
29. To selects the listing of files for the user whose login names or user ID numbers:
# lsof -u s
30. To selects the listing of UNIX domain socket files:
# lsof -U
31. To selects the listing of lsof version information:
# lsof -v
32. To directs lsof to indicate the items it was asked to list:
# lsof -V
33. To Enables (+) or disables (-) the suppression of warning messages:
# lsof -w
# lsof +w
34. To specifies how SELinux security contexts are to be handled:
# lsof -Z z