Skip to main content
p. 199

8.2 Finding Open Files with lsof

The lsof command lists open files and the processes using them. Because Unix places a lot of emphasis on files, lsof is among the most useful tools for finding trouble spots. But lsof doesn’t stop at regular files—it can list network resources, dynamic libraries, pipes, and more.

p. 201

8.2.1 Reading the lsof Output​

Running lsof on the command line usually produces a tremendous amount of output. The following is a fragment of what you might see. This output (slightly adjusted for readability) includes open files from the systemd (init) process as well as a running vi process:

# lsof

COMMAND  PID   USER   FD    TYPE    DEVICE  SIZE/OFF    NODE NAME
systemd    1   root  cwd     DIR    8,1      4096          2 /
systemd    1   root  rtd     DIR    8,1      4096          2 /
systemd    1   root  txt     REG    8,1   1595792    9961784 /lib/systemd/systemd
systemd    1   root  mem     REG    8,1   1700792    9961570 /lib/x86_64-linux-gnu/libm-2.27.so
systemd    1   root  mem     REG    8,1    121016    9961695 /lib/x86_64-linux-gnu/libudev.so.1

--snip--
vi      1994   juser  cwd    DIR    8,1      4096    4587522 /home/juser
vi      1994   juser   3u    REG    8,1     12288     786440 /tmp/.ff.swp

--snip--

The output lists the following fields in the top row:

COMMAND The command name for the process that holds the file descriptor.

PID The process ID.

USER The user running the process.

FD This field can contain two kinds of elements. In most of the preceding output, the FD column shows the purpose of the file. The FD field can also list the file descriptor of the open file—a number that a process uses together with the system libraries and kernel to identify and manipulate a file; the last line shows a file descriptor of 3.

TYPE The file type (regular file, directory, socket, and so on).

DEVICE The major and minor number of the device that holds the file.

SIZE/OFF The file’s size.

NODE The file’s inode number.

NAME The filename.

The lsof(1) manual page contains a full list of what you might see for each field, but the output should be self-explanatory. For example, look at the entries with cwd in the FD field. Those lines indicate the current working directories of the processes. Another example is the very last line, which shows a temporary file that a user’s vi process (PID 1994) is using.

note

You can run lsof as root or a regular user, but you’ll get more information as root.

p. 202

8.2.2 Using lsof​

There are two basic approaches to running lsof:

  • List everything and pipe the output to a command like less, and then search for what you’re looking for. This can take a while due to the amount of output generated.
  • Narrow down the list that lsof provides with command-line options.

You can use command-line options to provide a filename as an argument and have lsof list only the entries that match the argument. For example, the following command displays entries for open files in /usr and all of its subdirectories:

$ lsof +D /usr

To list the open files for a particular process ID, run:

$ lsof -p pid

For a brief summary of lsof’s many options, run lsof -h. Most options pertain to the output format. (See Chapter 10 for a discussion of the lsof network features.)

note

lsof is highly dependent on kernel information. If you perform a distribution update to both the kernel and lsof, the updated lsof might not work until you reboot with the new kernel.