How to list files and analyze your system with Linux lsof

The Linux tool, lsof, enables quick system monitoring and problem detection. It provides a list of open files, allowing you to optimize it for your specific needs using filters and options.

What is Linux lsof?

To monitor and analyze your Linux system, lsof is an easy-to-use tool. The program, developed and published in 1994 by Vic Abell, is open source and is part of the standard installation for numerous Linux distributions, such as Debian or Ubuntu. lsof stands for “List open files”. The program provides information about file types that are currently open or were previously opened by running processes. This includes regular files, directories, sockets, drives, and ports. It presents a clear and organized list of the different processes and associated files.

How does Linux lsof work?

If lsof is not present on your system, simply install it with this Linux command:

$ apt-get install lsof

Once installed, Linux lsof lets you to obtain a comprehensive overview of the active processes on your computer. This is possible because, under Unix-like systems, everything is treated as a file. As a result, you can use lsof to determine which processes can access a specific file.

What does the Isof syntax look like?

Want to use lsof? This is the basic syntax of the corresponding command:

$ lsof [Option] <Format>

While it is possible to use lsof without options or filters, it’s not advisable. The resulting output would be extensive and difficult to interpret.

Which options and filters are available with Linux lsof?

lsof understands numerous output options. The most important ones are:

• -F: This option ensures that all results are output in a single column.
• -l: This option lets you display the user ID instead of the name.
• -n: Using this option, the corresponding IP addresses are output instead of hostnames.
• -P: This is how the port numbers are displayed instead of the service names.
• -r [x]: This option ensures that the output is re-executed every x seconds.
• -t: With this option only a PID list (Process Identifier) is output.

In addition, lsof knows numerous filter options. The most common ones are:

• -a: This is a logical AND operation instead of the OR operation; it’s used by default.
• -c [Process]: Find out which file is used by which process.
• +D /file/user: This filter provides information about a specific directory and its user.
• /dev/drive: Use this filter to check a specific drive.
• -i [TCP/UDP or alternative IP address or port]: Provides information about which processes use which network services.
• +L1: Use this filter to get information about deleted files.
• +p PID: Provides information about the files used by which PID.
• /path/file: Provides information about a specific file.
• -u [User]: Find out which user is using which files.

What is Linux lsof being used for?

To conclude, we’ll show you how and for what lsof is being used by means of some examples.

$ lsof -u root

This lets you view all files that root currently keeps open.

$ lsof /mount/path

Frequently, lsof is used to identify programs that prevent the execution of the mount command. This task cannot be accomplished if related files are still open.

$ lsof -n -i

This command lets you list all open ports.