Exploring Essential Use Cases of the Command 'lsof' (with examples)

The lsof (List Open Files) command is a highly valuable tool in Unix-like operating systems, designed for listing all open files and the corresponding processes. Since nearly everything in Unix is represented as a file—including network sockets and devices—this command provides critical insight into the interactions between various system components. One of the key features of lsof is its ability to be used for network diagnostics, system monitoring, and troubleshooting. Do note, however, that root privileges or sudo are typically required to list files opened by other users. More detailed information can be found at lsof man page .

Use Case 1: Find the Processes that Have a Given File Open

Code:

lsof path/to/file

Motivation: Sometimes, a file might not be accessible or modifiable because it is being used by a system process or an application. Knowing which process has a particular file open can help in understanding system behavior or resolving file access issues.

Explanation:

• lsof: The base command stands for ’list open files'.
• path/to/file: This argument specifies the path to the file for which you want to find corresponding processes.

Example output:

COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
bash      1234    alice  3r   REG  202,1     4096 1048609 /home/alice/testfile

In this example, the bash process with PID 1234 opened the file located at /home/alice/testfile.

Use Case 2: Find the Process that Opened a Local Internet Port

Code:

lsof -i :port

Motivation: Network diagnostics often require knowing which application is using a particular network port. This could help identify unauthorized access or diagnose connectivity issues.

Explanation:

• -i: This option tells lsof to report on open network files.
• :port: This specifies the particular port number that you want to inspect.

Example output:

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
python    5678   bob    5u  IPv4 132412      0t0  TCP *:8080 (LISTEN)

Here, a python process with PID 5678 is listening on port 8080.

Use Case 3: Only Output the Process ID (PID)

Code:

lsof -t path/to/file

Motivation: In some scenarios, you might be particularly interested in just the PID of the process interacting with a file. This can be useful in scripting or automation when you intend to terminate the process.

Explanation:

• -t: This option outputs the PID only, without additional file information.
• path/to/file: Path to the file of interest.

Example output:

1234

The output 1234 represents the PID of the process using the specified file.

Use Case 4: List Files Opened by the Given User

Code:

lsof -u username

Motivation: Monitoring resources used by a specific user is essential for system administration and resource management. This helps ensure efficient use of system resources by different users or identify potential security issues.

Explanation:

• -u username: This specifies the username whose open files you want to list.

Example output:

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
vim       2345   alice  6u   REG  202,1    10240 1048610 /home/alice/.viminfo
ssh       2468   alice  3u  IPv4 132412      0t0  TCP local:22->remote:63342

The user alice has file descriptors open under processes like vim and ssh.

Use Case 5: List Files Opened by the Given Command or Process

Code:

lsof -c process_or_command_name

Motivation: To understand how a specific application interacts with the file system, you might want to see all open files associated with a given command or process.

Explanation:

• -c process_or_command_name: Filters open files by the command name provided.

Example output:

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
nginx     8912   root   6u   REG  253,0    36436 255381 /var/log/nginx/access.log
nginx     8912   root   7u   REG  253,0     1629 255382 /var/log/nginx/error.log

The command nginx has opened log files in this example.

Use Case 6: List Files Opened by a Specific Process, Given its PID

Code:

lsof -p PID

Motivation: Sometimes you might have the PID from another source, and you wish to know exactly what resources or files this process is currently utilizing. This facilitates detailed process monitoring.

Explanation:

• -p PID: This option tells lsof to list the files opened by the specific PID provided.

Example output:

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
java      8423   tom    1w   REG  202,2    4096 1048621 /tmp/java-app.log

The process with PID 8423 has a write access to /tmp/java-app.log.

Use Case 7: List Open Files in a Directory

Code:

lsof +D path/to/directory

Motivation: Understanding what files are open in a particular directory can be crucial for tasks like backup operations or maintenance where certain files might need to be closed or unmounted.

Explanation:

• +D path/to/directory: This option lists all open files within the specified directory recursively.

Example output:

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
bash      3210   bob    3r   REG  202,1    20480 1048622 /home/bob/projects/code.py
vim       5113   bob    4u   REG  202,1     4096 1048623 /home/bob/projects/notes.txt

Files such as code.py and notes.txt in the /home/bob/projects directory are open by bash and vim respectively.

Use Case 8: Find the Process that is Listening on a Local IPv6 TCP Port and Do not Convert Network or Port Numbers

Code:

lsof -i6TCP:port -sTCP:LISTEN -n -P

Motivation: IPv6 networks necessitate commands that cater specifically to them. It is especially useful in environments configured for IPv6 to identify listening ports without converting port and network numbers to presentation format.

Explanation:

• -i6TCP:port: Focuses the search on TCP over IPv6 connections, using the specified port.
• -sTCP:LISTEN: Limits the results to listening sockets, often useful in server configurations.
• -n: Prevents the conversion of network numbers to host names, increasing speed.
• -P: Prevents port number conversion to service names, displaying numerical ports as specified.

Example output:

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd      9292   root   3u  IPv6 148772      0t0  TCP *:22 (LISTEN)

A process sshd is listening on TCP port 22 over IPv6.

Conclusion:

The lsof command is a versatile tool that serves a wide array of purposes, essential for system administration, troubleshooting, and security audits. The various use cases enable users to gain insights into file-system interactions, network ports in use, and specific user or process activity, turning the black-box nature of running systems into a more transparent and manageable environment. By mastering the lsof command, system administrators and developers can significantly enhance their ability to understand and control their systems.