Learn how to use lsof to see what files are open on your system.
One of the unique things about Unix and Linux is that everything is a file. Of course, there are many different kinds of files, including regular files, directory files, and device files. Even interprocess communication mechanisms, such as pipes and semaphores, are files.
Because everything is a file, a running system has a very large number of open files at any given point in time. What if you want to know what files are open, what files a specific process has open, what files on a specific device are open, or what files a specific user has open? Enter List Open Files, or lsof, which can do this and more. lsof was written by Victor Abell and is available from http://people.freebsd.org/~abe/. You can also install lsof on Debian with the quick apt-get install lsof.
lsof, is an extremely useful and powerful tool that shows you all open files. A quick look at the lsof man page reveals just how many options the command has. But (to paraphrase Spider-Man) with flexibility comes complexity. If you get overwhelmed by the man page, try lsof –h, which produces a small and digestible lsof cheat sheet of sorts.
usage: [-?abhlnNoOPRstUvV] [+|-c c]
[+|-d s] [+D D] [+|-f]
[-F [f]] [-g [s]] [-i [i]]
[+|-L [l]] [+m [m]] [+|-M]
[-o [o]] [-p s] [+|-r [t]] [-S [t]]
[-T [t]] [-u s] [+|-w] [-x [fl]]
The bundled 00QUICKSTART file in the lsof source code is also a good place to start. Let’s take a brief look at some lsof features.
Typing lsof with no options lists all open files that belong to any active process. As you may have expected, the list is extremely long and is of limited use. It does, however, serve as in easy way to see just how many open files your system really does have. (An lsof|wc –l on the test system outputs 4935.
Like X-Ray Vision
Now, on to some examples.
To see who is using mplayer, run lsof `which mplayer`. To see the process IDs using the mplayer binary, type lsof –t `which mplayer`. And to see what files are being used by mplayer, use lsof –c mplayer.
To see the files that user jeremy has open, try lsof –u jeremy. To see a list of files open by process 123, enter lsof –p 123. To see what files (recursively) are open in /tmp, run lsof+D /tmp. To list all open Internet sockets, use lsof –i, and to see all Internet sockets listening on port 25, use lsof –i:25.
As these couple of examples quickly show, lsof and the “everything is a file” concept are quite powerful. Why would you actually need to use lsof? Have you ever tried to unmount a filesystem, but couldn’t, because the system insists device is busy? This means one of more files on that filesystem are open, and without lsof, it can be difficult to find out exactly what needs to be closed. Because Internet sockets are files, lsof can tell you what process and user is connected to a specific host. For example, to see who on the system is connected to Google, type lsof –firstname.lastname@example.org. lsof also allows you to get a list of open NFS files with using lsof –N.
In addition to the aforementioned talents, many of the lsof options allow you to use regular expressions.
Want to see all open files on the system except those owned by the user jeremy? Run lsof –u ^jeremy. You can also combine multiple options using boolean AND/OR logic in a single command. For instance, lsof –u jeremy –a /dev/hda7 shows you all of the files on /dev/hda7 that the user jeremy has open. The combination of boolean operators and regular expressions translates to almost limitless options.
There are a couple of things to keep in mind. You may notice that some commands show different output depending on whether you run them as root. This has to do with permissions, so if you aren’t seeing something you think you should be seeing, try running lsof as root. Also, a variety of things from DNS lookups to lstat() can cause lsof to appear to hang. There are a number of command-line options you can use to avoid this.” Section 14″ of the 00QUICKSTART file is a good place to start if this happens.
After getting comfortable with the basics of lsof, don’t be afraid to jump into its man page to unlock the full potential that lsof holds. While it can be a little intimidating at first, lsof is invaluable. Now that you know a little about lsof, go ahead and open up your Linux system.
Jeremy Garcia is the founder and administrator of LinuxQuestions.org, a free, friendly, and active Linux community. Please send questions and feedback to