10 lsof command usages with example – Unix/Linux

lsof command lists open files. It’s the short form of “LiSt Open Files.” This command has a vital role in server Administration. This command reveals the files which are opened by a process. In Linux/Unix, everything is considered as a file such as pipes, sockets, devices etc are treated as files. Thus, by using ‘lsof’ command we will get the information of any opened files.

1, List all open files using lsof command

# lsof

This command long lists all the open files belonging to all active processes currently running on the server/system. The image added below will give you a close view on it.

lsof1

In the above screenshot, you can see some columns such as command, PID, user, FD, TYPE etc

FD - File descriptor

Some of the values in FD are

cwd - Current working directory
txt - Text file
mem - Memory Mapped file
mmap - Memory Mapped device
Number - It represent the actual file descriptor. For example, 0u, 1w and 3r

r represents read, w represents write and u represents both read and write.

Type represents type of the file. Some of the values of TYPE are

>REG - Regular file 
>DIR - Directory
>CHR - Character special file
>FIFO - First in first out

2, To list user specific opened files

# lsof -u user_name

Yeah, the ablove command will lists all opened files by processes for a specific user on your server.

Example:

# lsof -u crybit
COMMAND   PID   USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAME
sshd    29609 crybit  cwd    DIR            144,233     4096  117711421 /
sshd    29609 crybit  rtd    DIR            144,233     4096  117711421 /
sshd    29609 crybit  txt    REG            144,233   409488  119020186 /usr/sbin/sshd
sshd    29609 crybit  mem    REG            144,241          2443001619 (deleted)/dev/zero (stat: No such file or directory)
sshd    29609 crybit  mem    REG               8,37           119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119021984 /lib64/security/pam_succeed_if.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119022000 /lib64/security/pam_limits.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119021960 /lib64/security/pam_keyinit.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119021972 /lib64/security/pam_cracklib.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119021987 /lib64/security/pam_nologin.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119021988 /lib64/security/pam_deny.so (path dev=144,233)
sshd    29609 crybit  mem    REG               8,37           119019223 /usr/lib64/libcrack.so.2.8.0 (path dev=144,233)
.....
.....

3, Process running on a port

# lsof -i :port_number

This lists all opened files for processes running on a specific port.

Example:

# lsof -i :22
COMMAND   PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
sshd      769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)
sshd      769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)
# lsof -i :3306
COMMAND   PID  USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
mysqld  11106 mysql   10u  IPv4 2340975114      0t0  TCP *:mysql (LISTEN)

4, Lists only IPv4 and IPv6 open files

# lsof -i 4  - For IPv4

Example:

# lsof -i 4
COMMAND     PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
sshd        769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)
named      8362  named   20u  IPv4 2334751017      0t0  TCP localhost.localdomain:domain (LISTEN)
named      8362  named   21u  IPv4 2334751019      0t0  TCP crybit.com:domain (LISTEN)
named      8362  named   22u  IPv4 2334751021      0t0  TCP localhost.localdomain:rndc (LISTEN)
named      8362  named  512u  IPv4 2334751016      0t0  UDP localhost.localdomain:domain 
named      8362  named  513u  IPv4 2334751018      0t0  UDP crybit.com:domain 
tcpserver  9975   root    3u  IPv4 2335487959      0t0  TCP *:pop3 (LISTEN)
tcpserver  9978   root    3u  IPv4 2335487967      0t0  TCP *:pop3s (LISTEN)
tcpserver  9983   root    3u  IPv4 2335487997      0t0  TCP *:imap (LISTEN)
tcpserver  9987   root    3u  IPv4 2335488014      0t0  TCP *:imaps (LISTEN)
xinetd    10413   root    5u  IPv4 2336070983      0t0  TCP *:ftp (LISTEN)
xinetd    10413   root    6u  IPv4 2336070984      0t0  TCP *:smtp (LISTEN)
mysqld    11106  mysql   10u  IPv4 2340975114      0t0  TCP *:mysql (LISTEN)
# lsof -i 6

Example:

# lsof -i 6
COMMAND   PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
sshd      769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)
named    8362  named   23u  IPv6 2334751024      0t0  TCP localhost.localdomain:rndc (LISTEN)
httpd   29241   root    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)
httpd   29241   root    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)
httpd   29243 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)
httpd   29243 apache    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)
httpd   29244 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)
httpd   29244 apache    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)
httpd   29245 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)
httpd   29245 apache    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)
httpd   29246 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)

5, Lists open files for TCP port ranges 1-1024

# lsof -i :1-1024

This is very helpful to know the open files for processes running under a specific port range.

Example:

# lsof -i :1-1024
COMMAND     PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
sshd        769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)
sshd        769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)
named      8362  named   20u  IPv4 2334751017      0t0  TCP localhost.localdomain:domain (LISTEN)
named      8362  named   21u  IPv4 2334751019      0t0  TCP crybit.com:domain (LISTEN)
named      8362  named   22u  IPv4 2334751021      0t0  TCP localhost.localdomain:rndc (LISTEN)
named      8362  named   23u  IPv6 2334751024      0t0  TCP localhost.localdomain:rndc (LISTEN)
tcpserver  9975   root    3u  IPv4 2335487959      0t0  TCP *:pop3 (LISTEN)
tcpserver  9978   root    3u  IPv4 2335487967      0t0  TCP *:pop3s (LISTEN)
tcpserver  9983   root    3u  IPv4 2335487997      0t0  TCP *:imap (LISTEN)
tcpserver  9987   root    3u  IPv4 2335488014      0t0  TCP *:imaps (LISTEN)
xinetd    10413   root    5u  IPv4 2336070983      0t0  TCP *:ftp (LISTEN)
xinetd    10413   root    6u  IPv4 2336070984      0t0  TCP *:smtp (LISTEN)
httpd     29241   root    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)
httpd     29241   root    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)
httpd     29243 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)
....
....

6, Lists by pid

# lsof -p PID

This is the most commonly using command as in most case we need to list open files for a specific PID.

Example:

# lsof -p 11106
COMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAME
mysqld  11106 mysql  cwd    DIR            144,233     4096  119025114 /var/lib/mysql
mysqld  11106 mysql  rtd    DIR            144,233     4096  117711421 /
mysqld  11106 mysql  txt    REG            144,233  9484782  119025094 /usr/libexec/mysqld
mysqld  11106 mysql  mem    REG               8,37           119025094 /usr/libexec/mysqld (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119021830 /lib64/libnss_files-2.5.so (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119021841 /lib64/libsepol.so.1 (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119021801 /lib64/libselinux.so.1 (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119021785 /lib64/libresolv-2.5.so (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119021920 /lib64/libkeyutils-1.2.so (path dev=144,233)
mysqld  11106 mysql  mem    REG               8,37           119017006 /usr/lib64/libkrb5support.so.0.1 (path dev=144,233)
....
....

7, Kill all activity for a particular user

# killall -9 `lsof -t -u username`

8, Opened files in a directory

# lsof +D path_of_the_directory

Example:

# lsof +D /var/log/
COMMAND     PID   USER   FD   TYPE  DEVICE SIZE/OFF      NODE NAME
syslogd    9729   root    1w   REG 144,233        0 119019158 /var/log/kernel
syslogd    9729   root    2w   REG 144,233   350722 119021699 /var/log/messages
syslogd    9729   root    3w   REG 144,233   591577 119019159 /var/log/secure
syslogd    9729   root    4w   REG 144,233   591577 119019159 /var/log/secure

9, Opened files based on process names

# lsof -c process_name

Example:

# lsof -c ssh
COMMAND     PID USER   FD   TYPE     DEVICE SIZE/OFF    NODE NAME
sshd        483 root  cwd    DIR        8,9     4096       2 /
sshd        483 root  rtd    DIR        8,9     4096       2 /
sshd        483 root  txt    REG        8,9   523488 1193409 /usr/sbin/sshd

10, List all network connections.

# lsof -i 

This command lists all network connections “Listening and Established.”

Example:

# lsof -i
COMMAND     PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
sshd        769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)
sshd        769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)
named      8362  named   20u  IPv4 2334751017      0t0  TCP localhost.localdomain:domain (LISTEN)
named      8362  named   21u  IPv4 2334751019      0t0  TCP crybit.com:domain (LISTEN)
named      8362  named   22u  IPv4 2334751021      0t0  TCP localhost.localdomain:rndc (LISTEN)
named      8362  named   23u  IPv6 2334751024      0t0  TCP localhost.localdomain:rndc (LISTEN)
named      8362  named  512u  IPv4 2334751016      0t0  UDP localhost.localdomain:domain

That’s it!! 🙂

Other commands:
groupdel, groupmems, groupmod, useradd , usermod , chgrp, chown, ls, head, tail, top, ps, find, crontab, ftp commands, tar, rpm, rkhunter, Rsync, grepnetstat command’s practical usagesOpenVZ commands

Arunlal Ashok

Linux Server Administrator. I’m managing Linux servers since 2012. I started this blog to share and discuss my ideas.

Any questions? Write to arun (@) crybit.com

You may also like...

2 Responses

  1. Votspile says:

    I can’t believe you made me go into page inspector and delete your adblock-blocker DIV to read your page. Such a pain.

Leave a Reply

Your email address will not be published. Required fields are marked *