lsof - Unix, Linux Command

NAME

lsof: list open files.

SYNOPSIS

lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g[s] ] [ -i [i] ] 
[ -k k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ][ -o [o] ] [ -p s ] [ +|-r [t[m]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] 
[ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]

DESCRIPTION

An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path. Instead of a formatted display, lsof will produce output that can be parsed by other programs. In addition to producing a single output list, lsof will run in repeat mode. In repeat mode it will produce output, delay, then repeat the output operation until stopped with an interrupt or quit signal.

Options

Tag	Description
-? -h	These two equivalent options select a usage (help) output list. Lsof displays a shortened form of this output when it detects an error in the options supplied to it, after it has displayed messages explaining each error. .
-a	This option causes list selection options to be ANDed, as described above.
-A A	This option is available on systems configured for AFS whose AFS kernel code is implemented via dynamic modules. It allows the lsof user to specify A as an alternate name list file where the kernel addresses of the dynamic modules might be found.
-b	This option causes lsof to avoid kernel functions that might block - lstat, readlink, and stat.
-cc	This option selects the listing of files for processes executing the command that begins with the characters of c. Multiple commands may be specified, using multiple -c options. They are joined in a single ORed set before participating in AND option selection.
If	c begins with a '^', then the following characters specify a command name whose processes are to be ignored (excluded.)
+c w	This option defines the maximum number of initial characters of the name, supplied by the UNIX dialect, of the UNIX command associated with a process to be printed in the COMMAND column.
-C	This option disables the ratio of the components of path names of the kernel name cache. See the section CACHE OF NAMES OF CORE for more information.
d + s	This option tells lsof to search for all open instances of directory s and the files and directories it contains the first level. This option does NOT descend into the root directory tree s , and does not follow symbolic links within it. Option + D D can be used to request a search on the depth of the directory tree with the directory D to root.
-d s	This option selects the listing of files whose descriptors are present in all s comma-separated - eg, "1.3" or "6, cwd, 2". (There should not be any spaces in the set.)
-D+D	This option tells lsof to search for all open instances of directory D and all files and directories it contains to its maximum depth. Symbolic links within the directory D are ignored, ie d. not followed.
-D D	This option forces the use of the file cache devices by lsof. Using this option may be prohibited.
+ \| -f [CfgGn]	f clarifies itself how path name arguments are to be interpreted. When this option is followed by c , f , g , G or n in any combination, it specifies that the kernel file structure information of the list must be authorized ( "+") or prohibited ( "-" ).
-F f	This option specifies a list of characters, f , that selects the fields to go out for a treatment with another program, and the character that terminates each output field. Each field is specified to produce a single character in f .
-g [s]	This option selects the listing of files for the processes whose number IDentification process group (group ID) is present in all s comma-separated - eg, "123" or "123,456." (There should not be any space throughout.)
-i [i]	This option selects the listing of files whose Internet address matches the address specified with i . If no address is specified, this option selects the listing of all files and Internet networks x.25 (HP-UX).
-k k	This option specifies a kernel name list file, k , instead of / vmunix, / mach, etc. This option is not available on AIX on IBM RISC / System 6000.
-l	This option prevents the user ID conversion to login. It is also used when the research username is not working properly or too slowly.
+ \| -L [L]	This option allows ( "+") or off ( "-") the listing of file link counts when available - eg, they are not available for sockets, or most FIFOs (queues pending) and pipes. When + L is specified without a number after every link counts will be listed. When -L is specified (the default), no link counts will be listed. When + L is followed by a number, only files with a counter value of links below that number will be listed.
-m m	This option specifies a kernel memory file, c instead of / dev / kmem or / dev / mem - eg a memory dump file after a crash.
+ \| -M	Authorize ( + ) or disables ( - ) the registration reporting portmapper (portmapper) for local TCP and UDP ports. The default reporting mode is determined when building lsof with the #define HASPMAPENABLED the header file machine.h dialect used; lsof is distributed with this definition of disabled macro, and thus the ratio of the port manager is disabled by default and must be required with + M .
-not	This option prevents the conversion of network numbers (decimal places) to host names for network files. Prohibit the conversion can accelerate lsof. It is also useful when looking for host names is not working properly.
-NOT	This option selects the listing of NFS files.
-o	This option tells lsof to always display the position (offset) in the file. It causes replacement as the output column SIZE / OFF (size / pos) by OFFSET. Note: On some UNIX dialects lsof can not obtain accurate or consistent information on the position in the file from its kernel data sources, sometimes only for certain types of files read (eg, socket files.) FAQ lsof (section FAQ gives its location.)
o o	This option sets the number of decimal digits ( o ) to display after "0t" for a position in a file before it passes to the form "0x ...". A value of zero (unlimited) for o tells lsof to use the form "0t" for all position outputs.
-O	This option tells lsof to avoid the strategy it uses to avoid being blocked by some kernel operations - ie d.
-p s	This option selects the listing of files for the processes whose ID numbers are present in all comma-separated s - eg, "123" or "123,456." Multiple process ID numbers are combined in one set with the binary OR before participating in a selection and binary options.
-P	This option prevents the conversion of port numbers to port names for network files. Disable conversion can accelerate a little lsof. It is also useful when looking for host names is not working properly.
+ \| -r [t]	This option puts lsof in repeat mode. lsof list open files then selected by other options, waits t seconds (fifteen default), then repeats the listing, waiting list and repeatedly until stopped by a condition defined by the prefix of the option.
-R	This option tells lsof to list the ID numbers of parent processes (Parent Process IDentification number, PPID) in the PPID column.
-s	This option tells lsof to always display the file size. This causes replacement as the output column SIZE / OFF SIZE. If the file does not have size, nothing is displayed.
-S [T]	This option specifies an optional timeout value for kernel functions - lstat readlink and stat - that might otherwise lead to a deadlock. The minimum for t is two; the default, fifteen; when no value is specified, the default is used.
-T [T]	This option controls the information report TCP / TPI, also reported by netstat (1), following the network addresses. In normal output the information appears in parentheses, each item except state identified by a keyword.
-t	This option specifies that lsof should produce terse output with process identifiers only and no header - eg, so that the output can be piped to kill. This option selects the -w.
-u s	This option selects the listing of files for users whose name or user ID is present in all comma-separated s - eg "abe", or "548, root.Multiple logins and user ID numbers are combined in one set with the binary OR before participating in a selection and binary options
-U	This option selects the listing of UNIX domain socket files.
-v	This option selects the listing of a version of information lsof including: revision number; construction date ; identity of the builder and construction location; name of the compiler used; compiler version number if available; compiler options and charger used to build the binary lsof ; and information on the system, typically leaving the option -a of uname.
-V	This option directs lsof to indicate the items it was asked to list and has not found - command names, file names, addresses or Internet files, login names, NFS files, PIDs, PGIDs and UIDs. When other options are associated with a binary AND with options, lsof may not report that it failed to find a search item when an associated option with AND prevents the listing of the open file localized search item.
+\|-W	Authorize ( + ) or disables ( - ) the suppression of warning messages. The builder lsof can choose to disable or enable the default warning messages. The default warning message status is shown in the output of the option -h or -? . Disable warning messages when they already are or activate them when they are already enabled is acceptable. The option -t selects the option -w.
-X	It is a dialect-specific option.

EXAMPLES

Example-1:

To list all Open Files:

# lsof

output:

# lsof
COMMAND    PID TID            USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
init         1                 root cwd       DIR              252,0     4096          2 /
init         1                 root rtd       DIR              252,0     4096          2 /
init         1                 root txt       REG              252,0   265848         54 /sbin/init
init         1                 root mem       REG              252,0    47712     393444 /lib/x86_64-linux-gnu/libnss_files-2.19.so
init         1                 root mem       REG              252,0    47760     393448 /lib/x86_64-linux-gnu/libnss_nis-2.19.so
init         1                 root mem       REG              252,0    97296     393438 /lib/x86_64-linux-gnu/libnsl-2.19.so
init         1                 root mem       REG              252,0    39824     393440 /lib/x86_64-linux-gnu/libnss_compat-2.19.so
init         1                 root mem       REG              252,0    14664     393401 /lib/x86_64-linux-gnu/libdl-2.19.so
init         1                 root mem       REG              252,0   252032     393460 /lib/x86_64-linux-gnu/libpcre.so.3.13.1
init         1                 root mem       REG              252,0   141574     393475 /lib/x86_64-linux-gnu/libpthread-2.19.so
init         1                 root mem       REG              252,0 1840928     393385 /lib/x86_64-linux-gnu/libc-2.19.so
init         1                 root mem       REG              252,0    31792     393481 /lib/x86_64-linux-gnu/librt-2.19.so
init         1                 root mem       REG              252,0    43464     393417 /lib/x86_64-linux-gnu/libjson-c.so.2.0.0
init         1                 root mem       REG              252,0   134296     393483 /lib/x86_64-linux-gnu/libselinux.so.1
...

kworker/0    5                 root cwd       DIR              252,0     4096          2 /
kworker/0    5                 root rtd       DIR              252,0     4096          2 /
kworker/0    5                 root txt   unknown                                        /proc/5/exe

more...

Example-2:

To list User Specific Opened Files:

# lsof -u ubuntu

output:

COMMAND PID   USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAME
sshd    1427 ubuntu cwd    DIR              252,0     4096      2 /
sshd    1427 ubuntu rtd    DIR              252,0     4096      2 /
sshd    1427 ubuntu txt    REG              252,0   766784 800542 /usr/sbin/sshd
sshd    1427 ubuntu mem    REG              252,0    14464 393517 /lib/x86_64-linux-gnu/security/pam_env.so
sshd    1427 ubuntu mem    REG              252,0    22896 393526 /lib/x86_64-linux-gnu/security/pam_limits.so
sshd    1427 ubuntu mem    REG              252,0    10320 393530 /lib/x86_64-linux-gnu/security/pam_mail.so
sshd    1427 ubuntu mem    REG              252,0    10344 393532 /lib/x86_64-linux-gnu/security/pam_motd.so
sshd    1427 ubuntu mem    REG              252,0    14592 393455 /lib/x86_64-linux-gnu/libpam_misc.so.0.82.0
sshd    1427 ubuntu mem    REG              252,0    38920 393435 /lib/x86_64-linux-gnu/libnih-dbus.so.1.0.0
sshd    1427 ubuntu mem    REG              252,0    96280 393437 /lib/x86_64-linux-gnu/libnih.so.1.0.0
sshd    1427 ubuntu mem    REG              252,0   108480 393390 /lib/x86_64-linux-gnu/libcgmanager.so.0.0.0
sshd    1427 ubuntu mem    REG              252,0    42864 398327 /lib/x86_64-linux-gnu/security/pam_systemd.so
sshd    1427 ubuntu mem    REG              252,0    10376 393550 /lib/x86_64-linux-gnu/security/pam_umask.so
sshd    1427 ubuntu mem    REG              252,0    10288 393524 /lib/x86_64-linux-gnu/security/pam_keyinit.so
sshd    1427 ubuntu mem    REG              252,0    10344 393529 /lib/x86_64-linux-gnu/security/pam_loginuid.so
sshd    1427 ubuntu mem    REG              252,0    18752 393540 /lib/x86_64-linux-gnu/security/pam_selinux.so
sshd    1427 ubuntu mem    REG              252,0    10272 393534 /lib/x86_64-linux-gnu/security/pam_nologin.so
sshd    1427 ubuntu mem    REG              252,0    18952 393388 /lib/x86_64-linux-gnu/libcap.so.2.24
sshd    1427 ubuntu mem    REG              252,0    10376 393513 /lib/x86_64-linux-gnu/security/pam_cap.so
sshd    1427 ubuntu mem    REG              252,0     6112 393535 /lib/x86_64-linux-gnu/security/pam_permit.so
sshd    1427 ubuntu mem    REG              252,0     6024 393515 /lib/x86_64-linux-gnu/security/pam_deny.so
sshd    1427 ubuntu mem    REG              252,0    60288 393551 /lib/x86_64-linux-gnu/security/pam_unix.so
sshd    1427 ubuntu mem    REG              252,0    22952 393442 /lib/x86_64-linux-gnu/libnss_dns-2.19.so

Example-3:

To find Processes running on Specific Port:

# lsof -i TCP:22

output:

# lsof -i TCP:22
COMMAND PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1053   root    3u IPv4 13211      0t0 TCP *:ssh (LISTEN)
sshd    1053   root    4u IPv6 13213      0t0 TCP *:ssh (LISTEN)
sshd    1377   root    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd    1427 ubuntu    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd    1840   root    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
sshd    1930 ubuntu    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

Example-4:

To list Only IPv4 & IPv6 Open Files:

# lsof -i 4

# lsof -i 6

output:

# lsof -i 4
COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
dhclient 869            root    6u IPv4 11754      0t0 UDP *:bootpc
dhclient 869            root   20u IPv4 11700      0t0 UDP *:26374
sshd     1053            root    3u IPv4 13211      0t0 TCP *:ssh (LISTEN)
dnsmasq 1372 libvirt-dnsmasq    4u IPv4 13970      0t0 UDP *:bootps
dnsmasq 1372 libvirt-dnsmasq    6u IPv4 13973      0t0 UDP 192.168.122.1:domain
dnsmasq 1372 libvirt-dnsmasq    7u IPv4 13974      0t0 TCP 192.168.122.1:domain (LISTEN)
sshd     1377            root    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd     1427          ubuntu    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd     1840            root    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
sshd     1930          ubuntu    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

# lsof -i 6
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
dhclient 869 root   21u IPv6 11701      0t0 UDP *:22830
sshd     1053 root    4u IPv6 13213      0t0 TCP *:ssh (LISTEN)

Example-5:

To list Open Files of TCP Port ranges 1-1024:

# lsof -i TCP:1-1024

output:

# lsof -i TCP:1-1024
COMMAND PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    1053            root    3u IPv4 13211      0t0 TCP *:ssh (LISTEN)
sshd    1053            root    4u IPv6 13213      0t0 TCP *:ssh (LISTEN)
dnsmasq 1372 libvirt-dnsmasq    7u IPv4 13974      0t0 TCP 192.168.122.1:domain (LISTEN)
sshd    1377            root    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd    1427          ubuntu    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd    1840            root    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
sshd    1930          ubuntu    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

Example-6:

To Exclude User with ‘^’ Characte

# lsof -i -u^root

output:

# lsof -i -u^root
COMMAND PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
dnsmasq 1372 libvirt-dnsmasq    4u IPv4 13970      0t0 UDP *:bootps
dnsmasq 1372 libvirt-dnsmasq    6u IPv4 13973      0t0 UDP 192.168.122.1:domain
dnsmasq 1372 libvirt-dnsmasq    7u IPv4 13974      0t0 TCP 192.168.122.1:domain (LISTEN)
sshd    1427          ubuntu    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd    1930          ubuntu    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

Example-7:

To find Out who’s Looking What Files and Commands:

# lsof -i -u user1

output:

# lsof -i -u user1
COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
dhclient 869            root    6u IPv4 11754      0t0 UDP *:bootpc
dhclient 869            root   20u IPv4 11700      0t0 UDP *:26374
dhclient 869            root   21u IPv6 11701      0t0 UDP *:22830
sshd     1053            root    3u IPv4 13211      0t0 TCP *:ssh (LISTEN)
sshd     1053            root    4u IPv6 13213      0t0 TCP *:ssh (LISTEN)
dnsmasq 1372 libvirt-dnsmasq    4u IPv4 13970      0t0 UDP *:bootps
dnsmasq 1372 libvirt-dnsmasq    6u IPv4 13973      0t0 UDP 192.168.122.1:domain
dnsmasq 1372 libvirt-dnsmasq    7u IPv4 13974      0t0 TCP 192.168.122.1:domain (LISTEN)
sshd     1377            root    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd     1427          ubuntu    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd     1840            root    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
sshd     1930          ubuntu    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

Example-8:

To list all Network Connections:

# lsof -i

output:

# lsof -i
COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
dhclient 869            root    6u IPv4 11754      0t0 UDP *:bootpc
dhclient 869            root   20u IPv4 11700      0t0 UDP *:26374
dhclient 869            root   21u IPv6 11701      0t0 UDP *:22830
sshd     1053            root    3u IPv4 13211      0t0 TCP *:ssh (LISTEN)
sshd     1053            root    4u IPv6 13213      0t0 TCP *:ssh (LISTEN)
dnsmasq 1372 libvirt-dnsmasq    4u IPv4 13970      0t0 UDP *:bootps
dnsmasq 1372 libvirt-dnsmasq    6u IPv4 13973      0t0 UDP 192.168.122.1:domain
dnsmasq 1372 libvirt-dnsmasq    7u IPv4 13974      0t0 TCP 192.168.122.1:domain (LISTEN)
sshd     1377            root    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd     1427          ubuntu    3u IPv4 13987      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)
sshd     1840            root    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
sshd     1930          ubuntu    3u IPv4 14871      0t0 TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)

Example-9:

To list processes which opened a specific file:

# lsof /var/log/syslog

output:

# lsof /var/log/syslog
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 687 syslog 1w REG 252,0 1812935 11325 /var/log/syslog

Example-10:

To list opened files under a directory:

# lsof +D /var/log/

output:

# lsof +D /var/log/
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
init        1   root   14w   REG 252,0      733 11346 /var/log/upstart/systemd-logind.log
rsyslogd 687 syslog    1w   REG 252,0 1813034 11325 /var/log/syslog
rsyslogd 687 syslog    2w   REG 252,0 1694014 11335 /var/log/kern.log
rsyslogd 687 syslog    4w   REG 252,0    39603 11870 /var/log/auth.log
libvirtd 1171   root    4w   REG 252,0        0 135812 /var/log/libvirt/libvirtd.log

Example-11:

To list opened files based on process names:

# lsof -c ssh -c init

output:

COMMAND PID   USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAME
init       1   root cwd    DIR              252,0     4096      2 /
init       1   root rtd    DIR              252,0     4096      2 /
init       1   root txt    REG              252,0   265848     54 /sbin/init
init       1   root mem    REG              252,0    47712 393444 /lib/x86_64-linux-gnu/libnss_files-2.19.so
init       1   root mem    REG              252,0    47760 393448 /lib/x86_64-linux-gnu/libnss_nis-2.19.so
init       1   root mem    REG              252,0    97296 393438 /lib/x86_64-linux-gnu/libnsl-2.19.so
init       1   root mem    REG              252,0    39824 393440 /lib/x86_64-linux-gnu/libnss_compat-2.19.so
init       1   root mem    REG              252,0    14664 393401 /lib/x86_64-linux-gnu/libdl-2.19.so
init       1   root mem    REG              252,0   252032 393460 /lib/x86_64-linux-gnu/libpcre.so.3.13.1
init       1   root mem    REG              252,0   141574 393475 /lib/x86_64-linux-gnu/libpthread-2.19.so
init       1   root mem    REG              252,0 1840928 393385 /lib/x86_64-linux-gnu/libc-2.19.so
init       1   root mem    REG              252,0    31792 393481 /lib/x86_64-linux-gnu/librt-2.19.so
init       1   root mem    REG              252,0    43464 393417 /lib/x86_64-linux-gnu/libjson-c.so.2.0.0

more....

Print Page