Description :

We can use the lsof command to know if someone is using a file, and if they are, who.

It reads kernel memory in its search for open files and helps you list all open files. In this case, an open file may be a regular file, a directory, a block special file, a character special file, a stream, a network file and many others – because in Linux everything is a file.

Lsof is used on a file system to identify who is using any files on that file system. You can run lsof command on Linux filesystem and the output identifies the owner and process information for processes using the file as shown in the following output.

$ lsof /dev/null

List of All Opened Files in Linux

[root@server ~]# lsof /dev/null
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
systemd       1     root    0u   CHR    1,3      0t0 1035 /dev/null
systemd       1     root    1u   CHR    1,3      0t0 1035 /dev/null
imap       1979 jaipur    0w   CHR    1,3      0t0 1035 /dev/null
imap       1979 jaipur    9w   CHR    1,3      0t0 1035 /dev/null
systemd-j  1993     root    0r   CHR    1,3      0t0 1035 /dev/null
imap       6153 jaipur    0w   CHR    1,3      0t0 1035 /dev/null
imap       6153 jaipur    9w   CHR    1,3      0t0 1035 /dev/null
imap       6245 jaipur    0w   CHR    1,3      0t0 1035 /dev/null
imap       6245 jaipur    9w   CHR    1,3      0t0 1035 /dev/null
imap       6328 jaipur    0w   CHR    1,3      0t0 1035 /dev/null
imap       6328 jaipur    9w   CHR    1,3      0t0 1035 /dev/null
imap       6360 jaipur    0w   CHR    1,3      0t0 1035 /dev/null
imap       6360 jaipur    9w   CHR    1,3      0t0 1035 /dev/null
exim       6453 mailnull    0u   CHR    1,3      0t0 1035 /dev/null
exim       6453 mailnull    1u   CHR    1,3      0t0 1035 /dev/null
exim       6453 mailnull    2u   CHR    1,3      0t0 1035 /dev/null
imap       6535 jaipur    0w   CHR    1,3      0t0 1035 /dev/null
imap       6535 jaipur    9w   CHR    1,3      0t0 1035 /dev/null

To list user specific opened files, run the following command replace jaipur with the actual user name.

$ lsof -u jaipur

List of files Opened Files in Linux

[root@server ~]# lsof -u jaipur
COMMAND    PID     USER   FD      TYPE             DEVICE SIZE/OFF     NODE NAME
imap      1979 jaipur  cwd       DIR              202,1     4096   934273 /home/jaipur/mail/jaipurshosting
imap      1979 jaipur  rtd       DIR              202,1     4096        2 /
imap      1979 jaipur  txt       REG              202,1  1611149  1573420 /usr/libexec/dovecot/imap
imap      1979 jaipur  mem       REG              202,1   150108  1991442 /usr/lib64/dovecot/
imap      1979 jaipur  mem       REG              202,1   141968  1709124 /usr/lib64/libpthread-2.17.so
imap      1979 jaipur  mem       REG              202,1   157424  1708710 /usr/lib64/liblzma.so.5.2.2
imap      1979 jaipur  mem       REG              202,1    68192  1709202 /usr/lib64/libbz2.so.1.0.6
imap      1979 jaipur  mem       REG              202,1    90248  1708428 /usr/lib64/libz.so.1.2.7
imap      1979 jaipur  mem       REG              202,1   193860  1991437 /usr/lib64/dovecot/lib20_zlib_plugin.so

Another important use of lsof is to find out the process listening on a specific port.

For example identify the process listening on port 80 using the following command.

$ sudo lsof -i TCP:80

Find Out Process Listening Port

[root@server ~]# sudo lsof -i TCP:80
COMMAND   PID   USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
httpd   14964 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   14964 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)
httpd   14975 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   14975 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)
httpd   14977 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   14977 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)
httpd   15752 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   15752 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)
httpd   15753 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   15753 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)
httpd   15754 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   15754 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)
httpd   15755 nobody    3u  IPv4 67600630      0t0  TCP *:http (LISTEN)
httpd   15755 nobody    4u  IPv6 67600631      0t0  TCP *:http (LISTEN)

Note: Since lsof reads kernel memory in its search for open files, rapid changes in kernel memory may result into unpredictable outputs. This is one of the major downsides of using lsof command.

For more information, look at the lsof man page:

$ man lsof

We hope you’ve found this useful!