Master lsof: Inspect Open Files, Find Processes, and Recover Deleted Data

lsof Overview

lsof (list open files) is a tool that lists all open files on a system. In Linux, everything is a file, so opened files can be regular files, directories, network file system files, character devices, pipes, sockets, etc.

To see which files are currently open and obtain related information, use the lsof command.

Basic Usage

View files opened by a process

Example: list files used by MySQL # lsof -c mysql Find the process using a specific file

Example: see which process is accessing the system log file

# lsof /var/log/messages

Practical Cases

(1) Show files accessed by a given PID # lsof -p PID This is useful when the system experiences high I/O load; tools like top or iotop can identify the offending processes, and lsof reveals which files those processes are using to diagnose the issue.

(2) Identify which process is using a specific port

Example command: # lsof -i:PORT_NUMBER This helps determine whether an unknown port is being used, which can indicate a security problem.

(3) Recover deleted files

In Linux, deleted files remain accessible if a process still holds them open. To recover a deleted log file, first confirm a process is using it, then copy the file descriptor.

Check which process is using the file: # lsof | grep message Rewrite the file (replace PORT_NUMBER with the appropriate descriptor):

# cat /proc/PORT_NUMBER/fd/2 > /var/log/messages