About lsof Command

If you want to quickly see the name of files that have been opened by a particular process (or all processes), the lsof command lets you do that. An open file could be a regular file, directory, library, block special file, character special file, an executing text reference, or even a stream or a network file.

1. How to list all open files

To list all open files, run the lsof command without any arguments:

lsof

The first column represents the process while the last column contains the file name. For details on all the columns, head to the command's man page.

2. How to list files opened by processes belonging to a specific user

The tool also allows you to list files opened by processes belonging to a specific user. This feature can be accessed by using the -u command line option.

lsof -u [user-name]

For example:

lsof -u root

3. How to list files based on their Internet address

The tool lets you list files based on their Internet address. This can be done using the -i command line option. For example, if you want, you can have IPv4 and IPv6 files displayed separately. For IPv4, run the following command:

lsof -i 4 

Similarly, for IPv6, run the following command:

lsof -i 6 

For example:

lsof -i 6

4. How to list files specific to a process

The tool also lets you display opened files based on process identification (PID) numbers. This can be done by using the -p command line option. 

lsof -p [PID]

For example:

lsof -p 2066

Moving on, you can also exclude specific PIDs in output by adding the ^ symbol before them. To exclude a specific PID, you can run the following command:

lsof -p [^PID]

For example:

lsof -p ^1

5. How to list IDs of processes that have opened a particular file

The tool allows you to list IDs of processes that have opened a particular file. This can be done by using the -t command line option.

$ lsof -t [file-name]

For example:

$ lsof -t  /lib/i386-linux-gnu/libaudit.so.1.0.0

6. How to limit lsof to a particular directory

If you want, you can also make lsof search for all open instances of a directory (including all the files and directories it contains). This feature can be accessed using the +D command line option.

$ lsof +D [directory-path]

For example:

$ lsof +D  /usr/lib/locale

7. How to list all Internet and x.25 (HP-UX) network files

This is possible by using the -i command line option we described earlier. Just that you have to use it without any arguments.

$ lsof -i

8. How to list open files based on port range

The utility also allows you to list open files based on a specific port or port range. For example, to display open files for port 1-1024, use the following command:

$ lsof -i :1-1024

9. How to list open files based on type of connection (TCP or UDP)

The tool allows you to list files based on the type of connection. For example, for UDP specific files, use the following command:

$ lsof -i udp

Similarly, you can make lsof display TCP-specific files.

10. How to make lsof list Parent PID of processes

There's also an option that forces lsof to list the Parent Process IDentification (PPID) number in the output. The option in question is -R.

$ lsof -R

To get PPID info for a specific PID, you can run the following command:

$ lsof -p [PID] -R

For example:

$ lsof -p 3 -R