lsof stands for "list open files" (in Spanish, "lista de archivos abiertos"); it is used on many Unix-like systems to obtain a list of all open files and the processes that opened them. You can also use it to list connections in a similar way to netstat or ss.

This open-source utility was developed and supported by Victor A. Abell, the retired Associate Director of the Purdue University Computing Center. In most Clouding Linux images it is installed by default. An equivalent of lsof on Windows would be handle and ListDLLs from Sysinternals by Mark Russinovich (through a GUI with Process Explorer).

Below is a table of contents with some usage examples and relevant information about the lsof command:

• Installing lsof

• Output columns

• Examples

  • List all files opened by processes

  • List processes by file

  • List open files by user

  • List files opened by a process

  • List open files by PID

  • List connections by process

  • List connections by PID, user, or process name

  • List connections by port

  • List IPv4 or IPv6 connections

• More information

Installing lsof

To install lsof, simply use your distribution's package manager:

# yum install lsof -y

# apt install lsof -y

Output columns

The default lsof output structure is as follows:

Below is a brief explanation of all the fields:

Examples

List all files opened by processes

To list all open files, simply run lsof:

# lsof | less

Adding the less command lets you view the content more comfortably.

List processes by file

To list the processes for a specific open file, enter the path and file as an argument:

# lsof /ruta/archivo

Replace "/ruta/archivo" with the desired open file.

List open files by user

With the following command, you can list the files that a particular user has open:

# lsof -u usuario

Replace "usuario" with the desired system user.

List files opened by a process

To list the files opened by a process, you can use its name as follows:

# lsof -c nombre_proceso

Remember to replace "nombre_proceso" with the name of the process in question.

List open files by PID

To list open files by the process's PID, simply run:

# lsof -p numero_PID

Replace "numero_PID" with the process identification number (you can obtain it with the command top).

List connections by process

To list connections opened by processes: 

# lsof -i

You will get a list; you can use less to make it easier to read.

List connections by PID, user, or process name

You can combine the option to list connections with, for example, a process identification number:

# lsof -i -a -p numero_pid

You can also use other arguments such as the user (-u), file, or process name (-c), as well as filter by port or IP protocol.

List connections by port

To list connections on a specific port, simply run:

# lsof -i :numero_puerto

After the colon, add the port number in question ("numero_puerto").

List IPv4 or IPv6 connections

List IPv4 connections:

# lsof -i4

You can use it in combination with other arguments, and for IPv6 it would be:

# lsof -i6

An example combination is the following:

# lsof -i6 :numero_puerto

You would get the IPv6 connections on a specific port.

More information

As you have seen, lsof is a very useful tool, and you can combine it with different commands. One example would be using Kill to kill all processes in an lsof result; an example of this is killing all of a user's processes:

# kill -9 $(lsof -t -u usuario) 

You can also combine arguments; the following would show files opened by a specific process belonging to a user:

# lsof -u usuario -c nombre_proceso

Finally, using the help argument (-h) will give you more information about lsof:

lsof 4.93.2
  latest revision: https://github.com/lsof-org/lsof
  latest FAQ: https://github.com/lsof-org/lsof/blob/master/00FAQ
  latest (non-formatted) man page: https://github.com/lsof-org/lsof/blob/master/Lsof.8
  usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-E] [+|-e s] [+|-f[gG]]
  [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
  [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]
Defaults in parentheses; comma-separated set (s) items; dash-separated ranges.
  -?|-h list help          -a AND selections (OR)    -b avoid kernel blocks
  -c c cmd c ^c /c/[bix]   +c w COMMAND width (9)    +d s dir s files
  -d s select by FD set    +D D dir D tree *SLOW?*   +|-e s exempt s *RISKY*
  -i select IPv[46] files  -K [i] list|(i)gn tasKs   -l list UID numbers
  -n no host names         -N select NFS files       -o list file offset
  -O no overhead *RISKY*   -P no port names          -R list paRent PID
  -s list file size        -t terse listing          -T disable TCP/TPI info
  -U select Unix socket    -v list version info      -V verbose search
  +|-w Warnings (+)        -X skip TCP&UDP* files    -Z Z context [Z]
  -- end option scan
  -E display endpoint info           +E display endpoint info and files
  +f|-f +filesystem or -file names   +|-f[gG] flaGs
  -F [f] select fields; -F? for help
  +|-L [l] list (+) suppress (-) link counts < l (0 = all; default = 0)
                                     +m [m] use|create mount supplement
  +|-M portMap registration (-)      -o o o 0t offset digits (8)
  -p s exclude(^)|select PIDs        -S [t] t second stat timeout (15)
  -T qs TCP/TPI Q,St (s) info
  -g [s] exclude(^)|select and print process group IDs
  -i i select by IPv[46] address: [46][proto][@host|addr][:svc_list|port_list]
  +|-r [t[m<fmt>]] repeat every t seconds (15); + until no files, - forever.
         An optional suffix to t is m<fmt>; m must separate t from <fmt> and
        <fmt> is an strftime(3) format for the marker line.
  -s p:s exclude(^)|select protocol (p = TCP|UDP) states by name(s).
  -u s exclude(^)|select login|UID set s
  -x [fl] cross over +d|+D File systems or symbolic Links
  names select named files or files on named file systems

We hope this article has helped you. If you still have questions about this or any other issue related to your servers on Clouding, write to us at soporte@clouding.io. We're here to help! 😉