LSOF command examples

Today we will see lsof command examples and practical usage of lsof command. Before that let’s see what’s lsof?

Lsof command is a short form of listing open files.  It’s a utility on a Linux system that will list the information of the files that are currently in opened state or are opened by a process.

If you simply type lsof command on a terminal it will list all the active files.

Installation of lsof command

[root@centos7 ~]# yum install lsof

Lsof command usage:-

See the default output of lsof command it will show all the active files.

[root@centos7 ~]# lsof
COMMAND    PID  TID    USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
systemd      1         root  cwd       DIR              253,0       224         64 /
systemd      1         root  rtd       DIR              253,0       224         64 /
systemd      1         root  txt       REG              253,0   1632960  538226417 /usr/lib/systemd/systemd
systemd      1         root  mem       REG              253,0     20064  537322022 /usr/lib64/libuuid.so.1.3.0
systemd      1         root  mem       REG              253,0    265576  537881327 /usr/lib64/libblkid.so.1.1.0
init       1       root    0u      CHR        1,3       0t0       4369 /dev/null
init       1       root    1u      CHR        1,3       0t0       4369 /dev/null
init       1       root    2u      CHR        1,3       0t0       4369 /dev/null
init       1       root    3r     FIFO        0,8       0t0       6323 pipe
what does lsof command mean. Explanation of lsof command

if you want to see what processes a particular file has opened you can use the command below.

[root@centos7 ~]# lsof script.sh
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF       NODE NAME
sh      10869 root  255r   REG  253,0       61 1610824772 script.sh
[root@centos7 ~]#

In the example above, I have created a simple script.sh with while loop and it’s running.  So when I do lsof script.sh it will show you all the processes opened by the file.

To see the files opened by a particular user use the command below.

[root@centos7 ~]# lsof -u centos
COMMAND     PID   USER   FD   TYPE             DEVICE  SIZE/OFF       NODE NAME
sshd      23686 centos  cwd    DIR              253,0       224         64 /
sshd      23686 centos  rtd    DIR              253,0       224         64 /
sshd      23686 centos  txt    REG              253,0    852888  537356191 /usr/sbin/sshd
sshd      23686 centos  mem    REG              253,0     15488  537355571 /usr/lib64/security/pam_lastlog.so
sshd      23686 centos  mem    REG              253,0     15648  537355550 /usr/lib64/libpam_misc.so.0.82.0
sshd      23686 centos  mem    REG              253,0    309248  538226413 /usr/lib64/security/pam_systemd.so
sshd      23686 centos  mem    REG              253,0     19616  537355572 /usr/lib64/security/pam_limits.so
sshd      23686 centos  mem    REG              253,0     11168  537355570 /usr/lib64/security/pam_keyinit.so

If you use the root instead of centos and grep script it will show script.sh is still running

[root@centos7 ~]# lsof -u root | grep script
sh        10881 root  255r      REG              253,0        70 1610824772 /root/script.sh

Network connections

[root@centos7 ~]# lsof -i
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
chronyd   650 chrony    5u  IPv4  15523      0t0  UDP localhost:323
chronyd   650 chrony    6u  IPv6  15524      0t0  UDP localhost:323
dhclient  799   root    6u  IPv4  17173      0t0  UDP *:bootpc
sshd      986   root    3u  IPv4  18026      0t0  TCP *:ssh (LISTEN)
sshd      986   root    4u  IPv6  18035      0t0  TCP *:ssh (LISTEN)
master   1233   root   13u  IPv4  18729      0t0  TCP localhost:smtp (LISTEN)
master   1233   root   14u  IPv6  18730      0t0  TCP localhost:smtp (LISTEN)

Similarly, you can just check out the network connections just for IPV6

[root@centos7 ~]# lsof -i 6
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
chronyd  650 chrony    6u  IPv6  15524      0t0  UDP localhost:323
sshd     986   root    4u  IPv6  18035      0t0  TCP *:ssh (LISTEN)
master  1233   root   14u  IPv6  18730      0t0  TCP localhost:smtp (LISTEN)

Similarly, if you want to exclude IPV6 from lsof command and just see IPV4 then you can type 4 instead of 6

[root@centos7 ~]# lsof -i 4
COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
chronyd   650 chrony    5u  IPv4  15523      0t0  UDP localhost:323
dhclient  799   root    6u  IPv4  17173      0t0  UDP *:bootpc
sshd      986   root    3u  IPv4  18026      0t0  TCP *:ssh (LISTEN)
master   1233   root   13u  IPv4  18729      0t0  TCP localhost:smtp (LISTEN)

If you want to see all the processes opened by a PID then use the command below

[root@centos7 ~]# lsof -p 650
COMMAND PID   USER   FD   TYPE             DEVICE SIZE/OFF      NODE NAME
chronyd 650 chrony  cwd    DIR              253,0      224        64 /
chronyd 650 chrony  rtd    DIR              253,0      224        64 /
chronyd 650 chrony  txt    REG              253,0   269392 537537844 /usr/sbin/chronyd
chronyd 650 chrony  mem    REG              253,0    68192 536928494 /usr/lib64/libbz2.so.1.0.6
chronyd 650 chrony  mem    REG              253,0   157424 536928468 /usr/lib64/liblzma.so.5.2.2
chronyd 650 chrony  mem    REG              253,0    90176 536910258 /usr/lib64/libz.so.1.2.7
chronyd 650 chrony  mem    REG              253,0    99944 536928565 /usr/lib64/libelf-0.176.so
chronyd 650 chrony  mem    REG              253,0    88720 536870988 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
chronyd 650 chrony  mem    REG              253,0   338672 537381838 /usr/lib64/libdw-0.176.so
chronyd 650 chrony  mem    REG              253,0    43712 536910244 /usr/lib64/librt-2.17.so

Kill all processes of a particular

Many times you will have the situation where you want to kill the processes opened by a particular user, maybe he is doing some weird stuff or running too many scripts which is slowing down the server.

Kill -9 `lsof -t -u justgeek`

You can also see the open files for a particular file system as well for example

[root@centos7 ~]# lsof /var/log

I hope you have mastered LSOF command examples and checkout Shells in Linux

Leave a Comment