Mastering lsof: List Open Files, Processes, and Network Connections on Linux

lsof (list open files) is a command‑line utility that reports information about files opened by processes on Linux, where everything—regular files, pipes, sockets, directories, devices—is treated as a file.

1. Basic Usage

Running lsof without arguments prints a list of all open files for all active processes.

# lsof
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
init        1 root   cwd  DIR      8,1   4096    2   /
init        1 root   txt  REG      8,1 124704 917562 /sbin/init
…

Each line represents an open file; most columns are self‑explanatory. Two columns often need clarification:

FD (file descriptor) – examples: cwd (current working directory), txt (program text), mem (memory‑mapped file), mmap (memory‑mapped device), or a numeric descriptor such as 1u where the letter indicates the mode (r = read, w = write, u = read/write).

TYPE – file type, e.g., REG (regular file), DIR (directory), FIFO (named pipe), CHR (character device).

2. Filtering Examples

List files opened by a specific file

# lsof /var/log/syslog
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
rsyslogd 488 syslog 1w   REG      8,1   1151 268940 /var/log/syslog

List files under a directory

Use +D to recurse into a directory (or +d for a non‑recursive listing).

# lsof +D /var/log/
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
rsyslogd 488 syslog 1w   REG      8,1   1151 268940 /var/log/syslog
…

Filter by process name

# lsof -c ssh -c init
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
ssh-agent 1528 user 1u   CHR      1,3   0t0   4369 /dev/null
…

Filter by user

# lsof -u lakshmanan
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
update-no 1892 lakshmanan 20r FIFO 0,8 0t0 14536 pipe
bash      1995 lakshmanan  cwd DIR 8,1 4096 393218 /home/lakshmanan

To list files for all users except a specific one, prefix the user with ^ (e.g., -u ^lakshmanan).

Filter by PID

# lsof -p 1753
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
bash     1753 lakshmanan cwd DIR 8,1 4096 393571 /home/lakshmanan/test.txt
…

Kill all processes of a user that have open files

Use -t to output only PIDs and feed them to kill:

# kill -9 `lsof -t -u lakshmanan`

Repeated mode

With -r or +r, lsof repeats the listing after a delay (specified after the option). -r continues indefinitely; +r stops when no files match.

# lsof -u lakshmanan -c init -a -r5
=======
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
inita.sh  2971 lakshmanan cwd DIR 8,1 4096 393218 /home/lakshmanan
…
=======

3. Network‑Related Listings

List all network connections

# lsof -i
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
avahi-dae 515 avahi 13u  IPv4   6848   0t0   UDP *:mdns
cupsd    1075 root   5u   IPv6  22512   0t0   TCP ip6-localhost:ipp (LISTEN)

Use -i4 or -i6 to restrict to IPv4 or IPv6.

List network files used by a specific process

# lsof -i -a -p 234

List processes listening on a specific port

# lsof -i :25
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
exim4    2541 Debian-exim 3u IPv4 8677   TCP localhost:smtp (LISTEN)

List only TCP or only UDP connections

# lsof -i tcp
# lsof -i udp

List NFS files

Use -N to show NFS files; combine with other filters as needed.

# lsof -N -u lakshmanan -a

Source: https://bbs.huaweicloud.com/blogs/364149