Looking for a way to list running files and associated processes in Linux? Fortunately, the lsof command can do that for you! Here’s a guide on how to use the lsof command on Linux.
Linux distributions are widely known for their powerful Command Line Interfaces. The Command Terminal allows its users to find, manage, and change the files’ attributes within the system.
One such command used to retrieve information about open files is the lsof command. Learning more about this command will help you retrieve information about open files more efficiently when compared to its GUI counterpart.
This guide will help you learn how to use the lsof command on Linux. We’ll go over the basics of the command, its syntax, and some examples that show how to use it.
Understanding the $lsof Command
The $lsof command is an acronym for “List Open Files”. As the name suggests, the command displays the files that are open on the system and the processes that use them.
The command is useful for getting information about a file and its associated processes. This information can be used to learn more about the object that requires changes with some other command.
These processes can then be called, modified, or terminated using other Terminal commands.
Installing the $lsof Command
Unlike most Linux commands, the $lsof command isn’t directly available on many Linux distributions. However, the command can easily be installed via the Terminal.
Note: The syntax for installation varies for each Linux distribution, so make sure you’re aware of what Linux distribution you are using. For this guide, we’ll use Ubuntu 22.04 LTS, based on Debian.
To install the $lsof command, open the Command Terminal, and type one of the following based on your Linux distribution:
If you’re using Ubuntu/Debian based distribution, type the following:
$ sudo apt install lsof
If you’re using a Linux distribution based on CentOS, type the following:
$ sudo yum install lsof
You can also use the following command if you’re on CentOS or RHEL8
$ sudo dnf install lsof
Wait for the installation to finish. Once that’s done, you’re ready to use the $ls command.
Syntax of the $lsof Command
The $lsof command has the following syntax:
$ lsof <options> <name of user>
Here, options refer to a list of flags that are associated with the $lsof command, and the user refers to the user whose programs you wish to list.
In case you wish to display root-related processes, you’ll use the following command:
$ sudo lsof <options> <name of user>
While there are a lot of options available with the $lsof command, some are more common than others. Here’s a list of options that are commonly associated with the $lsof command.
man: Opens the manual.<path>| grep deleted: Displays deleted files that were locked.-d mem: Displays the files that were mapped onto the memory-t<name of file>: Displays the Process IDs(PIDs) of processes that called upon a specific file.-i: Displays the processes based on the network.-i:<port ranges>: Displays the processes active on a specific range of ports.-i:<port number>: Displays the processes active on a single port.-i <tcp or udp>: Displays files based on the type of connection(TCP/IP or UDP).-i <IP>: Displays the files by filtering them using IP.+D <path of directory>: Displays the files present in the given directory.-R: Displays the PIDs of parent processes.-p <PID>: Display files that are linked to a specific PID.-p ^<PID>: Displays all the linked files except for the specified PID.-c <process name>: Displays the files that were called by a specific process.
Now that we’ve covered the major options associated with $lsof, let’s take a look at a few examples of how to use it.
Example 1: Displaying All Open Files
This is the main function of the $lsof command. It displays all open files along with certain attributes.
Here’s how you can use the $lsof command to display all files within a system.
- Begin by opening the Command Terminal on your system.
- Once the Terminal is open, type the following:
$ lsof
This will display all open files as shown in the image below:
As you can see, the $lsof command displays relevant information by dividing it into different sections. A description of each section is given below.
- COMMAND refers to the command type.
- PID refers to the Process ID.
- USER refers to the user owning the process.
- FD refers to “File Descriptor”. These are used to specify file locations/privileges.
- TYPE refers to a type of file.
- Device refers to the device number
- SIZE/OFF refers to the file size and its offset in terms of bytes.
- NODE NAME refers to the name of the node.
Example 2: Displaying Open Files Specified by Username
The $lsof command can also be used to display open files by a specific user. This can be done by opening the Command Terminal and typing the following:
$ lsof -u <name of user>
In our case,
$ lsof -u ubuntu
This will display all files that were opened by the user “ubuntu”.
Example 3: Displaying Processes Located on Network Ports
Aside from accessing files via usernames, you can also use the $lsof command to display processes that are running on specific ports.
This can be achieved by using $lsof with the -i option as follows:
$ lsof -i <TCP OR UDP port name>
For example,
$ lsof -i TCP: 80
You can also find active processes by specifying the range of the ports as follow:
$lsof -i TCP:1-512
This will output processes of TCP ports 1–512.
Example 4: Displaying Open Files While Excluding a User
If you want to view the open files while excluding a specific user, you can do so by using the exclude operator (^) in your command.
To exclude a user, you’ll type the following command:
$ lsof -i -u^<name of user>
For example,
$ lsof -i -u^root
Once you’re able to find specific processes, you’ll be able to configure what’s able to pass through your network. Having a tool that can allow you to manage your network from anywhere will make your life much easier. For this purpose, we recommend you learn how to use Netplan to ensure that configuring your network is a breeze.
This concludes our guide on how to use the lsof command on Linux. If you have any questions or suggestions, let us know in the comments.
If this guide helped you, please share it.
