lsof Command Examples in Linux

The lsof command prints a list of all files that are currently opened to all active processes. This can include everything from a text file to a device file—any object that the system can parse as a file. You may be prevented from modifying a file if it is opened in another process. By using lsof you can identify the offending process for termination. You can also use lsof to analyze how a process uses files, which can be helpful in identifying malicious processes or processes that have unwanted side effects.

The lsof command prints each file opened by a process on its own line. It prints information such as:

  • The name of the command/process.
  • The PID.
  • The invoking user.
  • The file descriptor (FD), including what permissions the file is open with.
  • The type of file.
  • The name of the file.


The syntax of the lsof command is:

$ lsof [options]

Listing all processes that have the home directory open.

lsof Command Examples in Linux

lsof Command Examples

1. To list all the open files:

# lsof

2. To get the lsof help:

# lsof -h
# lsof --help
# lsof -?

3. To list files for processes starting with specified character:

# lsof -c s

4. To avoid kernel functions:

# lsof -b

5. To disable the reporting of any path name components:

# lsof -C

6. To search for all open instances of directory s:

# lsof +d s

7. To list of file descriptors (FDs) to exclude from or include in the output:

# lsof -d s

8. To to search for all open instances of directory D and all the files and directories it contains to its complete depth:

# lsof +D D

9. To directs lsof’s use of the device cache file:

# lsof -D D

10. To specifies a character list:

# lsof -F f

11. To selects the listing of files for the processes whose optional process group IDentification (PGID) numbers are in the comma-separated set:

# lsof -g s

12. To the listing of files any of whose Internet address matches the address specified in i:

# lsof -i i

13. To specifies a kernel name list file:

# lsof -k k

14. To conversion of user ID numbers to login names:

# lsof -l

15. To enables (+) or disables (-) the listing of file link counts:

# lsof -L l
# lsof +L l

16. To specifies an alternate kernel memory file or activates mount table supplement processing:

# lsof -m m
# lsof +m m

17. To Enables (+) or disables (-) the reporting of portmapper registrations:

# lsof -M
# lsof +M

18. To inhibits the conversion of network numbers to host names for network files:

# lsof -n

19. To selects the listing of NFS files:

# lsof -n

20. To display file offset at all times:

# lsof -o

21. To define the number of decimal digits (o) to be printed after the ââ0tââ for:

# lsof -o o

22. To directs lsof to bypass the strategy it uses to avoid being blocked by some kernel operations:

# lsof -O

23. To excludes or selects the listing of files for the processes:

# lsof -p s

24. To option inhibits the conversion of port numbers to port names for network files:

# lsof -P

25. To puts lsof in repeat mode:

# lsof +r
# lsof -r

26. To directs lsof to display file size at all times:

# lsof -s

27. To controls the reporting of some TCP/TPI information:

# lsof -T

28. To specifies that lsof should produce terse output with process identifiers:

# lsof -t

29. To selects the listing of files for the user whose login names or user ID numbers:

# lsof -u s

30. To selects the listing of UNIX domain socket files:

# lsof -U

31. To selects the listing of lsof version information:

# lsof -v

32. To directs lsof to indicate the items it was asked to list:

# lsof -V

33. To Enables (+) or disables (-) the suppression of warning messages:

# lsof -w
# lsof +w

34. To specifies how SELinux security contexts are to be handled:

# lsof -Z z