Mastering lsof: List Open Files, Processes, and Network Connections on Linux

lsof (list open files) is a tool that lists the files currently opened on a system. In Linux, everything is represented as a file, including network connections and hardware, so each process has file descriptors that provide a uniform interface between the application and the operating system.

Because the list of file descriptors reveals a great deal about a process, lsof is very useful for system monitoring and troubleshooting.

Command syntax

lsof [options] [file]

Function

Shows the files opened by processes, the processes themselves, ports (TCP/UDP), and can recover deleted files. It is a convenient system monitoring tool, but because lsof needs to access kernel memory and various files, it usually requires root privileges.

Types of files lsof can list

Regular files

Directories

Network file system files

Character or device files

(Function) shared libraries

Pipes, named pipes

Symbolic links

Network files (e.g., NFS files, network sockets, Unix domain sockets)

Other types

Options

-a  List processes that have open files
-c<process_name>  List files opened by the specified process name
-g  Show GID details
-d<file_number>  List processes using the specified file descriptor
+d<directory>  List files opened under the given directory
+D<directory>  Recursively list files opened under the given directory
-n<directory>  List NFS files
-i<criteria>  List processes matching the given criteria (protocol, port, @ip)
-p<pid>  List files opened by the specified process ID
-u  Show UID details
-h  Display help information
-v  Display version information

Examples

1. No parameters

# lsof
COMMAND   PID USER   FD   TYPE   DEVICE   SIZE   NODE NAME
init       1 root   cwd  DIR    8,2      4096   2   /
... (additional output omitted for brevity) ...

2. Find processes using a specific file (e.g., /bin/bash)

# lsof /bin/bash
COMMAND   PID USER   FD   TYPE   DEVICE   SIZE   NODE NAME
bash    24159 root   txt  REG    8,2      801528 5368780 /bin/bash
... (additional output omitted) ...

3. Recursively list files in a directory

# lsof test/test3
COMMAND   PID USER   FD   TYPE   DEVICE   SIZE   NODE NAME
bash    24941 root   cwd  DIR    8,2      4096   2258872 test/test3
vi      24976 root   cwd  DIR    8,2      4096   2258872 test/test3
... (additional output omitted) ...

Other examples demonstrate how to list files opened by a specific user (lsof -u username), by a specific process name (lsof -c mysql), multiple processes (lsof -c mysql -c apache), files opened on particular ports (lsof -i :3306), all network connections (lsof -i), TCP connections (lsof -i tcp), UDP connections (lsof -i udp), network filesystems (lsof -N), and more advanced filters such as excluding users (lsof -u ^root) or process IDs (lsof -p ^1). These examples illustrate the flexibility of lsof for detailed system inspection.