Lsof is used on a file system to identify who is using any files on that file system. You can run the lsof command on Linux filesystem and the output identifies the owner and process information for processes using the file as shown in the following output.
$ lsof /dev/null
List of All Opened Files in Linux
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1480 rootadminz 0r CHR 1,3 0t0 6 /dev/null sh 1501 rootadminz 0r CHR 1,3 0t0 6 /dev/null sh 1501 rootadminz 1w CHR 1,3 0t0 6 /dev/null dbus-daem 1530 rootadminz 0u CHR 1,3 0t0 6 /dev/null xfce4-ses 1603 rootadminz 0r CHR 1,3 0t0 6 /dev/null xfce4-ses 1603 rootadminz 1w CHR 1,3 0t0 6 /dev/null at-spi-bu 1604 rootadminz 0r CHR 1,3 0t0 6 /dev/null dbus-daem 1609 rootadminz 0u CHR 1,3 0t0 6 /dev/null at-spi2-r 1611 rootadminz 0u CHR 1,3 0t0 6 /dev/null xfconfd 1615 rootadminz 0u CHR 1,3 0t0 6 /dev/null xfwm4 1624 rootadminz 0r CHR 1,3 0t0 6 /dev/null xfwm4 1624 rootadminz 1w CHR 1,3 0t0 6 /dev/null xfce4-pan 1628 rootadminz 0r CHR 1,3 0t0 6 /dev/null xfce4-pan 1628 rootadminz 1w CHR 1,3 0t0 6 /dev/null Thunar 1630 rootadminz 0r CHR 1,3 0t0 6 /dev/null Thunar 1630 rootadminz 1w CHR 1,3 0t0 6 /dev/null xfdesktop 1632 rootadminz 0r CHR 1,3 0t0 6 /dev/null xfdesktop 1632 rootadminz 1w CHR 1,3 0t0 6 /dev/null ....
To list user specific opened files, run the following command replace rootadminz with the actual user name.
$ lsof -u rootadminz
List of Files Opened by User
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1480 rootadminz cwd DIR 8,3 4096 2 / systemd 1480 rootadminz rtd DIR 8,3 4096 2 / systemd 1480 rootadminz txt REG 8,3 1595792 3147496 /lib/systemd/systemd systemd 1480 rootadminz mem REG 8,3 1700792 3150525 /lib/x86_64-linux-gnu/libm-2.27.so systemd 1480 rootadminz mem REG 8,3 121016 3146329 /lib/x86_64-linux-gnu/libudev.so.1.6.9 systemd 1480 rootadminz mem REG 8,3 84032 3150503 /lib/x86_64-linux-gnu/libgpg-error.so.0.22.0 systemd 1480 rootadminz mem REG 8,3 43304 3150514 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1 systemd 1480 rootadminz mem REG 8,3 34872 2497970 /usr/lib/x86_64-linux-gnu/libargon2.so.0 systemd 1480 rootadminz mem REG 8,3 432640 3150484 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1 systemd 1480 rootadminz mem REG 8,3 18680 3150450 /lib/x86_64-linux-gnu/libattr.so.1.1.0 systemd 1480 rootadminz mem REG 8,3 18712 3150465 /lib/x86_64-linux-gnu/libcap-ng.so.0.0.0 systemd 1480 rootadminz mem REG 8,3 27112 3150489 /lib/x86_64-linux-gnu/libuuid.so.1.3.0 systemd 1480 rootadminz mem REG 8,3 14560 3150485 /lib/x86_64-linux-gnu/libdl-2.27.so ...
Another important use of lsof is to find out the process listening on a specific port. For example identify the process listening on port 80 using the following command.
$ sudo lsof -i TCP:80
Find Out Process Listening Port
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 903 root 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1320 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1481 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1482 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1493 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1763 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 2027 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 2029 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 2044 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 3199 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 3201 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN)
Note:
Since lsof reads kernel memory in its search for open files, rapid changes in kernel memory may result into unpredictable outputs. This is one of the major downsides of using lsof command.
For more information, look at the lsof man page:
$ man lsof
