DEV Community

Cover image for Linux Insight Blogs: lsof
Ankur Singh
Ankur Singh

Posted on

Linux Insight Blogs: lsof

#linux #ubuntu #devops #productivity

Introduction

Welcome 👋 to this blog. In this blog we will gonna be learning about the lsof a command-line utility on Unix/Linux systems. A command-line utility is a program or tool that you run using CLI(Command Line Interface) instead of GUI(graphical user interface).

lsof

lsof stands for "list open files". It's a powerful command-line utility on Unix/Linux systems that shows you which files are open by which processes, users, port, specific process and many more. In Linux, everything is treated as a file, so it's important to know how to list specific files.

Let's get our hand dirty with code

Open your terminal by pressing CTRL + Alt + T.

  • Check all open files 
@Ankur:~$ lsof
COMMAND    PID  TID TASKCMD               USER   FD      TYPE DEVICE SIZE/OFF             NODE NAME
systemd      1                            root  cwd   unknown                                  /proc/1/cwd (readlink: Permission denied)
systemd      1                            root  rtd   unknown                                  /proc/1/root (readlink: Permission denied)
systemd      1                            root  txt   unknown                                  ...
Enter fullscreen mode Exit fullscreen mode

You will get a long list of files that are currently open on your file system.

  • Check processes using a specific file 
Ankur:~$ lsof /file/path
Enter fullscreen mode Exit fullscreen mode
  • Check files using the given port 
Ankur:~$ lsof -i :3000
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    3452 ankur   21u  IPv4  44686      0t0  TCP localhost:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Check files opened by a specific process 
Ankur:~$ lsof -p 3452
@Ankur:~$ lsof -p 3452
COMMAND  PID  USER   FD      TYPE DEVICE  SIZE/OFF  NODE NAME
node    3452 ankur  cwd       DIR   8,64      4096 43479 /home/ankur/node-webserver
node    3452 ankur  rtd       DIR   8,64      4096     2 /
...
Enter fullscreen mode Exit fullscreen mode
  • Check open network connections 
Ankur:~$ lsof -i
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    3717 ankur   21u  IPv4  52033      0t0  TCP localhost:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Show process that uses the internet connection now 
Ankur:~$ lsof -P -i -n
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    3725 ankur   21u  IPv4  44727      0t0  TCP 127.0.0.1:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Lists all listening ports together with the PID of the associated process 
Ankur:~$ lsof -Pan -i tcp -i udp
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    3725 ankur   21u  IPv4  44727      0t0  TCP 127.0.0.1:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Show all open ports 
Ankur:~$ lsof -Pnl -i
COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    3725     1000   21u  IPv4  44727      0t0  TCP 127.0.0.1:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • List all files opened by a particular command 
@Ankur:~$ lsof -c "node"
COMMAND  PID  USER   FD      TYPE DEVICE  SIZE/OFF  NODE NAME
node    3725 ankur  cwd       DIR   8,64      4096 43479 /home/ankur/node-webserver
node    3725 ankur  rtd       DIR   8,64      4096     2 /
Enter fullscreen mode Exit fullscreen mode
  • Show 10 largest open file 
Ankur:~$ lsof / | \
awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \
sort -n -u | tail | column -t
0MB        NAME                                              COMMAND
1.37904MB  /usr/bin/bash                                     bash
2.02687MB  /usr/lib/x86_64-linux-gnu/libc.so.6               sh
2.47214MB  /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33     node
5.05953MB  /usr/lib/x86_64-linux-gnu/libcrypto.so.3          sort
114.61MB   /home/ankur/.nvm/versions/node/v22.14.0/bin/node  node
Enter fullscreen mode Exit fullscreen mode
  • Show current working directory of a process 
Ankur:~$ lsof -p 3725 | grep cwd
node    3725 ankur  cwd       DIR   8,64      4096 43479 /home/ankur/node-webserver
Enter fullscreen mode Exit fullscreen mode

🎉 You nailed it

You’ve now learned how to use the lsof command to inspect open files, network ports, and running processes like a pro. It’s time to open your terminal and try these commands on your own system. Play around, explore, and see what's happening under the hood of your machine. Got something cool or unexpected? Share your findings or favorite lsof tricks in the comments below!

Reference

📧 Email: [email protected]
🔗 LinkedIn: Ankur Singh
🔗 Twitter: @ankur_136

Let's connect and create something great together!

Top comments (2)

Collapse
 
nevodavid profile image
Nevo David •

been cool seeing steady progress - it adds up. you think habit or curiosity makes you stick with learning this kinda stuff?

Collapse
 
dotallio profile image
Dotallio •

So many practical lsof examples here, love how you covered network ports and biggest files too! Ever used lsof to debug stubborn locked files in production?