Master Linux System Inspection: lsmod, lsof, lspci & lsscsi Commands Explained

lsmod

The lsmod command lists all kernel modules that are currently loaded into the Linux kernel. For each module it shows the module name, the size of the module in bytes, the number of other modules that depend on it, and a list of those dependent modules. lsmod Typical output columns:

Module – name of the kernel module.

Size – memory size of the module.

Used by – count of modules that depend on this one.

Dependent modules – names of modules that are using it.

Common usage is to pipe the output to grep to check for a specific module, e.g. lsmod | grep -i ext3.

lsof

The lsof utility reports a list of open files and the processes that opened them. In Linux, sockets, pipes, and devices are also represented as files, so lsof can be used to inspect network connections, deleted files that are still held open, and device usage. Root privileges are required to see information for processes owned by other users.

lsof [options]

Key options

-a – combine multiple selection criteria (logical AND).

-c process_name – show files opened by processes whose command name matches the given pattern.

-g – display the group ID (GID) of the process.

-d fd – list only entries that use the specified file descriptor number.

+d directory – list files opened under the given directory (non‑recursive).

+D directory – recursively list files opened under the given directory.

-i criteria – filter by network criteria such as protocol, port number, or IP address (e.g., -iTCP:80).

-p pid – show files opened by the process with the specified PID.

-u – display the user ID (UID) of the process.

-h – display a short help message.

-v – display version information.

Typical column meanings in the default output:

COMMAND – name of the process.

PID – process identifier.

PPID – parent process identifier (shown when -R is used).

USER – owner of the process.

PGID – process group ID.

FD – file descriptor used by the process (e.g., 1u for standard output).

lspci

The lspci command enumerates all PCI buses and devices attached to the host, providing details such as vendor ID, device ID, class, and human‑readable names.

lspci [options]

Important options

-n – show numeric vendor and device codes instead of names.

-t – display the hierarchy of buses, bridges, and devices as a tree.

-b – present a bus‑centric view.

-d vendor:device – limit output to a specific vendor/device pair.

-s bus:slot.function – select a particular device by its bus, slot, and function numbers.

-i file – use a custom ID list file instead of the default /usr/share/misc/pci.ids.

-m – produce machine‑readable output (key=value pairs).

lsscsi

The lsscsi utility lists SCSI devices attached to the system, showing information such as host controller, device type, size, and associated block device names.

lsscsi [options]

Common options

-s – display the size of each SCSI device.

-c – show the full default information line.

-d – display major and minor device numbers.

-g – show the corresponding sg device name.

-H – list host controllers (additional forms -Hl, -Hlv provide more detail).

-l – display related attributes; additional -ll, -lll, or -L increase verbosity.

-v – show the directory that contains device attributes.

-x – display the LUN number in hexadecimal.

-p – output DIF/DIX protection types.

-P – output valid protection mode information.

-i – show udev‑related attributes.

-w – display the World Wide Name (WWN) of the device.

These four commands together give a comprehensive view of kernel modules, open files and network sockets, PCI hardware, and SCSI storage devices, which is essential for system diagnostics, performance tuning, and troubleshooting on Linux servers.