Mastering lsof: List Open Files and Diagnose Linux Systems

lsof (list open files) is a Linux utility that enumerates all files currently opened by processes. In Unix‑like systems everything—regular files, sockets, devices, and even network connections—is represented as a file, and each open file is identified by a file descriptor.

Command format and purpose

The basic syntax is: lsof [options] [file] It displays the processes that have opened files, the files themselves, and the associated ports (TCP/UDP). Because lsof accesses kernel memory, it usually requires root privileges.

File types lsof can report

Ordinary files

Directories

Network file system files

Character or block device files

Shared libraries

Pipes and named pipes

Symbolic links

Network sockets (e.g., NFS, Unix domain sockets)

Other miscellaneous types

Key options

-a

Show only files that satisfy all given criteria. -c<process_name> List files opened by processes whose names match the pattern. -g Display GID information. -d<fd> Show files using the specified file descriptor. +d<directory> List files opened under the given directory (non‑recursive). +D<directory> Recursively list files opened under the directory. -n Show files on NFS mounts. -i<criteria> Filter by network criteria (protocol, port, IP). -p<pid> Show files opened by the given process ID. -u Show files opened by a specific UID. -h Display help. -v Display version.

Typical usage examples

1. List all open files (no options)

[root@localhost ~]# lsof
COMMAND   PID USER   FD   TYPE   DEVICE   SIZE   NODE   NAME
init        1 root   cwd  DIR    8,2      4096   2      /
... (additional rows omitted for brevity)

2. Find processes using a specific file

[root@localhost ~]# lsof /bin/bash
COMMAND   PID USER   FD   TYPE   DEVICE   SIZE   NODE   NAME
bash     24159 root   txt  REG    8,2    801528 5368780 /bin/bash
...

3. Recursively list files under a directory

[root@localhost ~]# lsof +D /opt/soft/test
COMMAND   PID USER   FD   TYPE   DEVICE   SIZE   NODE   NAME
bash     24941 root   cwd  DIR    8,2    4096   2258872 test/test3
vi       24976 root   cwd  DIR    8,2    4096   2258872 test/test3

4. Filter by user

lsof -u alice

5. Show network connections

lsof -i

6. Show only TCP connections

lsof -i tcp

7. Show processes listening on a specific port (e.g., MySQL port 3306)

lsof -i :3306

8. List files opened by a process name pattern

lsof -c mysql

9. Combine user and process filters

lsof -u test -c mysql

10. Exclude a user (e.g., hide root)

lsof -u ^root

11. Exclude a specific PID

lsof -p ^1

12. List all IPv4 network files for a given PID

lsof -i 4 -a -p 1234

13. Continuously monitor a set of ports on a remote host

lsof -i @peida.linux:20,21,22,25,53,80 -r 3

Column meanings

COMMAND – Process name.

PID – Process ID.

PPID – Parent PID (requires -R).

USER – Owner of the process.

PGID – Process group ID.

FD – File descriptor (e.g., cwd, txt, 0, 1, 2, etc.).

TYPE – File type (DIR, REG, CHR, FIFO, IPv4, etc.).

DEVICE – Device identifier.

SIZE – Size of the file.

NODE – Inode number.

NAME – Full name of the opened file.

Descriptor types and lock symbols

Common FD prefixes include cwd (current working directory), txt (program text or shared library), mem (memory‑mapped file), rtd (root directory), etc. After the descriptor, a mode character may appear: r (read), w (write), u (read/write). Lock symbols such as N, R, W, U indicate various lock states.

Notes

Standard input, output, and error are represented by descriptors 0, 1, and 2 respectively. Most user‑level file descriptors start at 3. When using options that filter by descriptor ( -d), remember that numeric values refer to these FD numbers.