Linux/Unix consider everything as file and maintains folder. So “Files or a File ” is very important in Linux/Unix. While working in Linux/Unix system there might be several file and folder which are being used, some of them would be visible and some not.
lsof command stands for List Of Open File. This command provides a list of files that are opened. Basically, it gives the information to find out the files which are opened by which process. With one go it lists out all open files in output console. It cannot only list common regular files but it can list a directory, a block special file, a shared library, a character special file, a regular pipe, a named pipe, an internet socket, a UNIX domain socket, and many others. it can be combined with grep command can be used to do advanced searching and listing.
Syntax:
$lsof [option][user name]
Options with Examples:
- List all open files: This command lists out all the files that are opened by any process in the system.
~$ lsof
- Here, you observe there are details of files which are opened. Process Id, the user associated with the process, FD(file descriptor), size of the file all together gives detailed information about the file opened by the command, process ID, user, its size etc.
- FD represents as File descriptor.
- cwd : Current working directory.
- txt : Text file.
- mem : Memory file.
- mmap : Memory mapped device.
- List all files opened by a user: There are several users of a system and each user have different requirements and accordingly they use files and devices. To find a list of files that are opened by a specific user this command is useful.
Syntax:
lsof -u username
- In the figure given above with the command lsof -u ubuntu lists out all the files opened by ubuntu user. Along with that we can see the type of file here and they are:
- DIR: Directory
- REG: Regular file
- CHR: Character special file
- List all files which are opened by everyone except a specific user: With the help of this command you can list out all the files opened by all the process and all the user. But when we want to find the list of files that are opened by all users except a particular user then we can use:
Syntax:
lsof -u ^root
- In the given figure we can observe there are no files that are opened by the root user.
- List all open files by a particular Process: This command can list out all the files opened by a particular process. -c followed by process names can find out all the files that are opened by that particular process that is named in the command.
Syntax:
lsof -c Mysql
- Here, you can observe that the files and their description opened by Mysql process. Another example is the files that are opened by the apache process:
- List all open files that are opened by a particular process: Each file is associated with some process ID. There can be many files that are opened by a particular process. By using lsof -p process ID, files opened by a particular process can be checked.
Syntax:
lsof -p process ID
- Files opened by all other PID: As the above-given figure command lists out the files opened by a particular process ID. In the same way, you can use below command option to find out the list of files which are not opened by a particular process ID.
Syntax:
lsof -p ^process ID
- List parent process IDs: There is a large number of process running in a system and they have files opened for its usage. There may be many child processes of a process and this process can also be termed as the parent process. To find out the list of files opened by parent process Id lsof command is used with the option -R.
Syntax:
$lsof -R
- Files opened by a directory: It lists out the files which are opened by a particular directory. There are files as well as the directory in a system. So there can be several files opened by a directory as well as the regular file.
Syntax:
$lsof -D directory path
- Files opened by network connections: Our Pc/system can be connected through various networks which helps in a variety of purpose. As we know that in Linux everything is a file, so we can even check the files that are opened by some network connections in the system.
Syntax:
$lsof -i
- Here in the figure, we can see the files opened by the TCP network. In the same way, we can check for UDP etc.
Note: To know more in details about the lsof command you can see the manual page as follows:
$ man lsof
