Why lsof Is the Go-To Linux Tool for Solving Port Conflicts and Disk Space Issues

What Is lsof

lsof stands for "list open files". In Linux, everything is a file, so lsof can inspect network connections, devices, pipes, and regular files, making it a powerful system‑diagnostic tool.

Basic Usage

The simplest invocation is lsof, which lists every open file but produces a huge amount of output, so it is rarely used without options.

Each output line contains fields such as COMMAND, PID, USER, FD, TYPE, DEVICE, SIZE/OFF, NODE, and NAME, describing the process, file descriptor, and file name or network information.

Network‑Related Uses

Checking Port Usage

# Find the process using port 80
lsof -i:80

# List all TCP connections
lsof -i tcp

# List all UDP connections
lsof -i udp

# Query a specific IP and port
lsof [email protected]:22

Example: a Redis service failed to start because port 6379 was held by a zombie process; lsof -i:6379 identified the culprit, which was then killed.

Viewing Connection States

# Show all network connections
lsof -i

# Show listening TCP sockets
lsof -i -sTCP:LISTEN

# Show established TCP sockets
lsof -i -sTCP:ESTABLISHED

This is useful when suspecting excessive connections for a service.

Process‑Related Uses

Listing Files Opened by a Process

# Files opened by PID 1234
lsof -p 1234

# Files opened by processes named nginx
lsof -c nginx

# Files opened by user www-data
lsof -u www-data

A Java application that reported "Too many open files" was diagnosed by counting files with lsof -p 12345 | wc -l, revealing a leak caused by unclosed temporary files.

Finding Which Processes Use a Specific File

# Which processes have /var/log/nginx/access.log open?
 lsof /var/log/nginx/access.log

# Which processes use files under /var/log/
 lsof +D /var/log/

This helps when a file cannot be deleted because it is still in use.

File‑System Related Tricks

Detecting Deleted but Still‑Open Files

Sometimes large files are deleted but disk space is not reclaimed because a process still holds them.

# Find deleted files still open
lsof | grep deleted

# More precise search
lsof +L1

In one incident, a log‑rotation script left a process writing to a deleted log file; restarting the process immediately freed the space.

Inspecting Mount‑Point Usage

# Show processes using /mnt/data
lsof /mnt/data

# Show all mount‑point usage on /dev/sda1
lsof -f -- /dev/sda1

Useful when an unmount fails with “device busy”.

Real‑World Case Studies

Case 1 – Resolving a Port Conflict

A new web service on port 8080 failed to start. lsof -i:8080 revealed that Jenkins had unexpectedly opened the port via a plugin.

Case 2 – Tracing File‑Handle Leakage

A Python app hit the "Too many open files" error. Using lsof -p showed a growing number of temporary files, leading to a code fix that properly closed file streams.

Case 3 – Investigating Disk‑Space Anomalies

Disk usage spiked to 95% with no obvious large files.

lsof | awk '$7 ~ /^[0-9]+$/ && $7 > 1000000 {print $2, $7, $9}' | sort -k2 -nr

uncovered a process writing to a several‑gigabyte file that had already been deleted.

Advanced Usage and Tips

Combining Conditions

By default, multiple criteria are OR‑ed; use -a for AND.

# OR relationship (default)
lsof -u www-data -i

# AND relationship
lsof -a -u www-data -i

Controlling Output Format

# Show IPs only
lsof -n -i

# Show numeric ports only
lsof -P -i

# Combine both for port 80
lsof -nP -i:80

Skipping DNS and service‑name resolution speeds up scripts.

Continuous Monitoring

# Refresh every 2 seconds
lsof -r 2 -i:80

# Exit when no output appears
lsof +r 1 -i:80

Useful for real‑time debugging of network connections.

Performance Optimization

Use specific options instead of a full scan.

Apply -n and -P to avoid DNS and port‑name lookups.

Cache results when invoking from scripts.

# Faster
lsof -nP -i:80

# Slower
lsof | grep :80

Common Pitfalls

Permission: some information requires root.

System load: running lsof on a heavily loaded host can affect performance.

Interpreting output: understanding fields like FD is essential.

FD meanings include cwd (current directory), txt (program code), mem (memory‑mapped file), numeric descriptors, and mode flags r/w/u.

Combining with Other Tools

# Pair with ps
lsof -p $(pgrep nginx)

# Compare with netstat
netstat -tlnp | grep :80
lsof -i:80

# Pipe to awk for further processing
lsof -i | awk '/ESTABLISHED/ {print $2}' | sort | uniq -c

Creating small scripts that chain lsof with grep, awk, or other utilities greatly improves troubleshooting efficiency.

Conclusion

lsof is an often‑underestimated utility that can resolve most file‑ and network‑related problems in production. From port conflicts to file‑handle leaks, disk‑space anomalies, and connection debugging, mastering lsof—and combining it with other command‑line tools—empowers operators to diagnose issues quickly and reliably.