How to List Open Files in Linux | lsof Command

In the world of Linux, understanding and managing open files is crucial for system administrators and users alike. The Linux operating system provides a powerful utility called lsof (List Open Files) that allows users to gain insights into the files currently open on their system. In this article, we will delve into the intricacies of the lsof command, exploring its syntax, options, and practical use cases.

Linux/Unix consider everything as file and maintains folder. So “Files or a File” is very important in Linux/Unix. While working in Linux/Unix system there might be several file and folder which are being used, some of them would be visible and some not. 

Understanding Isof (List Open Files)

lsof command stands for List Open Files. This command provides a list of files that are opened. Basically, it gives the information to find out the files which are opened by which process. With one go it lists out all open files in output console. It cannot only list common regular files but it can list a directory, a block special file, a shared library, a character special file, a regular pipe, a named pipe, an internet socket, a UNIX domain socket, and many others. it can be combined with grep command can be used to do advanced searching and listing. 

Syntax of List Open Files `lsof`

The basic syntax of the `lsof` command is as follows:

lsof [option]

here,

• lsof: This is the command itself, standing for “List Open Files.” It is the primary command used to gather information about open files and processes on a Linux system.
• [options]: This part of the syntax refers to the various options or flags that can be added to the lsof command to customize its behavior.

Options Available in lsof Command

Options	Description
-c <process_name>	List files opened by the specified process.
-u <username>	Display files opened by the specified user.
-i	Show network-related information.
-p <pid>	List files for a specific process ID.
-t	Display only the process IDs (PIDs) rather than full details.

Pratical Example of How to List Open File in Linux

1. How to list all open files on the system

List all open files: This command lists out all the files that are opened by any process in the system. 

lsof

Here, you observe there are details of files which are opened. Process Id, the user associated with the process, FD(file descriptor), size of the file all together gives detailed information about the file opened by the command, process ID, user, its size etc. 

• FD represents as File descriptor.
• cwd : Current working directory.
• txt : Text file.
• mem : Memory file.
• mmap : Memory mapped device.

2. How to show file opened by a particular user

List all files opened by a user: There are several users of a system and each user have different requirements and accordingly they use files and devices. To find a list of files that are opened by a specific user this command is useful. 

Syntax:

lsof -u username

Replace “username” with the desired username. This command provides a list of files opened by the specified user.

In the figure given above with the command lsof -u ubuntu lists out all the files opened by ubuntu user. Along with that we can see the type of file here and they are: 

• DIR: Directory
• REG: Regular file
• CHR: Character special file

3. How to List all files which are opened by everyone except a specific user

With the help of this command you can list out all the files opened by all the process and all the user. But when we want to find the list of files that are opened by all users except a particular user then we can use: 

Syntax:

lsof -u ^root

In the given figure we can observe there are no files that are opened by the root user.

4. How to list all open files by a particular process

This command can list out all the files opened by a particular process. -c followed by process names can find out all the files that are opened by that particular process that is named in the command. 

Syntax: 

lsof -c Mysql

Here, you can observe that the files and their description opened by Mysql process. Another example is the files that are opened by the apache process: 

5. How to List all open files that are opened by a particular process ID

Each file is associated with some process ID. There can be many files that are opened by a particular process. By using lsof -p process ID, files opened by a particular process can be checked. 

Syntax:

lsof -p process ID

6. Files opened by all other PID

As the above-given figure command lists out the files opened by a particular process ID. In the same way, you can use below command option to find out the list of files which are not opened by a particular process ID. 

Syntax:

lsof -p ^process ID

7. How to List parent process IDs

There is a large number of process running in a system and they have files opened for its usage. There may be many child processes of a process and this process can also be termed as the parent process. To find out the list of files opened by parent process Id lsof command is used with the option -R. 

Syntax:

lsof -R

8. How to list all opened files opened by a directory

It lists out the files which are opened by a particular directory. There are files as well as the directory in a system. So there can be several files opened by a directory as well as the regular file. 

Syntax:

lsof -D directory path

9. How to open Files by network connections

Our Pc/system can be connected through various networks which helps in a variety of purpose. As we know that in Linux everything is a file, so we can even check the files that are opened by some network connections in the system. 

Syntax:

lsof -i

Here in the figure, we can see the files opened by the TCP network. In the same way, we can check for UDP etc.

Note: To know more in details about the lsof command you can see the manual page as follows:  

man lsof

Conclusion

In this article we discussed knowing about open files is really important. There’s a handy tool called lsof (List Open Files) that helps us see what files are currently in use. This tool is like a detective that tells us which processes are using which files. In this article, we explored the lsof command, looking at its special words and how to use them. For example, we can find out all files open on our system or see which files a particular user is using. We can also check files related to network connections, directories, or even a specific process. Think of it like a super useful tool to understand what’s happening with files on your Linux system. To know even more details, there’s a guide you can read by typing man lsof. Happy exploring!