LSOF List Open Files - ryzendew/Linux-Tips-and-Tricks GitHub Wiki

LSOF (List Open Files) Troubleshooting for Beginners

Table of Contents

  1. :pencil: What is lsof?
  2. :zap: Basic Commands
  3. :bulb: Common Troubleshooting
  1. :keyboard: Quick Reference

:pencil: What is lsof?

  • lsof (List Open Files) shows which processes have files open
  • Displays files, directories, network connections, and devices in use
  • Essential for troubleshooting "file in use" errors
  • Usually requires root privileges for full information

What lsof can do:

  • Find what process is using a file
  • Show all files opened by a process
  • Find processes using a port
  • Display network connections
  • Troubleshoot file locking issues

:zap: Basic Commands

List All Open Files

sudo lsof

What this does:

  • Shows all open files for all processes
  • Very long output
  • Usually filtered or used with specific options

Note: May require sudo for full information.

Find Process Using a File

sudo lsof /path/to/file

What this does:

  • Shows which process has the file open
  • Useful for "file in use" errors
  • Helps identify what's preventing file operations

Example:

sudo lsof /var/log/syslog

Find Process Using a Directory

sudo lsof +D /path/to/directory

What this does:

  • Shows processes using files in a directory
  • Recursive (includes subdirectories)
  • Useful for unmounting filesystems

Show Files Opened by Process

sudo lsof -p 1234

What this does:

  • Shows all files opened by process ID 1234
  • Useful for seeing what a process is doing
  • Helps identify resource usage

Show Files Opened by Process Name

sudo lsof -c processname

What this does:

  • Shows files opened by processes matching the name
  • Partial matches work
  • Useful for finding all instances of a program

Example:

sudo lsof -c nginx

Find Process Using a Port

sudo lsof -i :80

What this does:

  • Shows which process is using port 80
  • Very useful for "port already in use" errors
  • Alternative to ss or netstat

Example:

sudo lsof -i :22    # SSH port
sudo lsof -i :443   # HTTPS port

Show Network Connections

sudo lsof -i

What this does:

  • Shows all network connections
  • Displays TCP and UDP connections
  • Similar to ss or netstat

Show TCP Connections Only

sudo lsof -iTCP

What this does:

  • Shows only TCP connections
  • Filters out UDP

Show Listening Ports

sudo lsof -iTCP -sTCP:LISTEN

What this does:

  • Shows only listening TCP ports
  • Useful for finding open services
  • Similar to ss -tln

:bulb: Common Troubleshooting

Find What's Using a Port

sudo lsof -i :80

Shows process using port 80.

Find What's Using a File

sudo lsof /path/to/file

Shows process with file open.

Find All Files for a User

sudo lsof -u username

Shows all files opened by a user.

Find Process Preventing Unmount

sudo lsof +D /mnt

Shows what's preventing unmounting /mnt.

:keyboard: Quick Reference

sudo lsof                          # All open files
sudo lsof /path/to/file            # File in use
sudo lsof +D /path/to/dir          # Directory in use
sudo lsof -p 1234                  # Process files
sudo lsof -c processname           # Process name
sudo lsof -i :80                   # Port in use
sudo lsof -iTCP -sTCP:LISTEN       # Listening ports
sudo lsof -u username               # User's files

For network connections, see the SS Network Troubleshooting Guide. For processes, see the PS Process Management Guide.