DEV Community

Cover image for Linux Insight Blogs: lsof
Ankur Singh
Ankur Singh

Posted on • Edited on

Linux Insight Blogs: lsof

#linux #ubuntu #devops #productivity

Introduction

Welcome 👋 to this blog. In this blog we will gonna be learning about the lsof a command-line utility on Unix/Linux systems. A command-line utility is a program or tool that you run using CLI(Command Line Interface) instead of GUI(graphical user interface).

lsof

lsof stands for "list open files". It's a powerful command-line utility on Unix/Linux systems that shows you which files are open by which processes, users, port, specific process and many more. In Linux, everything is treated as a file, so it's important to know how to list specific files.

Let's get our hand dirty with code

Open your terminal by pressing CTRL + Alt + T.

  • Check all open files 
@Ankur:~$ lsof COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd unknown /proc/1/cwd (readlink: Permission denied) systemd 1 root rtd unknown /proc/1/root (readlink: Permission denied) systemd 1 root txt unknown ...
Enter fullscreen mode Exit fullscreen mode

You will get a long list of files that are currently open on your file system.

  • Check processes using a specific file 
Ankur:~$ lsof /file/path
Enter fullscreen mode Exit fullscreen mode
  • Check files using the given port 
Ankur:~$ lsof -i :3000 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3452 ankur 21u IPv4 44686 0t0 TCP localhost:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Check files opened by a specific process 
Ankur:~$ lsof -p 3452 @Ankur:~$ lsof -p 3452 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3452 ankur cwd DIR 8,64 4096 43479 /home/ankur/node-webserver node 3452 ankur rtd DIR 8,64 4096 2 / ...
Enter fullscreen mode Exit fullscreen mode
  • Check open network connections 
Ankur:~$ lsof -i COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3717 ankur 21u IPv4 52033 0t0 TCP localhost:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Show process that uses the internet connection now 
Ankur:~$ lsof -P -i -n COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3725 ankur 21u IPv4 44727 0t0 TCP 127.0.0.1:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Lists all listening ports together with the PID of the associated process 
Ankur:~$ lsof -Pan -i tcp -i udp COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3725 ankur 21u IPv4 44727 0t0 TCP 127.0.0.1:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • Show all open ports 
Ankur:~$ lsof -Pnl -i COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3725 1000 21u IPv4 44727 0t0 TCP 127.0.0.1:3000 (LISTEN)
Enter fullscreen mode Exit fullscreen mode
  • List all files opened by a particular command 
@Ankur:~$ lsof -c "node" COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME node 3725 ankur cwd DIR 8,64 4096 43479 /home/ankur/node-webserver node 3725 ankur rtd DIR 8,64 4096 2 /
Enter fullscreen mode Exit fullscreen mode
  • Show 10 largest open file 
Ankur:~$ lsof / | \ awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \ sort -n -u | tail | column -t 0MB NAME COMMAND 1.37904MB /usr/bin/bash bash 2.02687MB /usr/lib/x86_64-linux-gnu/libc.so.6 sh 2.47214MB /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33 node 5.05953MB /usr/lib/x86_64-linux-gnu/libcrypto.so.3 sort 114.61MB /home/ankur/.nvm/versions/node/v22.14.0/bin/node node
Enter fullscreen mode Exit fullscreen mode
  • Show current working directory of a process 
Ankur:~$ lsof -p 3725 | grep cwd node 3725 ankur cwd DIR 8,64 4096 43479 /home/ankur/node-webserver
Enter fullscreen mode Exit fullscreen mode

🎉 You nailed it

You’ve now learned how to use the lsof command to inspect open files, network ports, and running processes like a pro. It’s time to open your terminal and try these commands on your own system. Play around, explore, and see what's happening under the hood of your machine. Got something cool or unexpected? Share your findings or favorite lsof tricks in the comments below!

Reference

📧 Email: ankursingh91002@gmail.com
🔗 LinkedIn: Ankur Singh
🔗Twitter: @ankur_136

Let's connect and create something great together!

Top comments (6)

Collapse
 
nevodavid profile image
Nevo David •

been cool seeing steady progress - it adds up. you think habit or curiosity makes you stick with learning this kinda stuff?

Collapse
 
ankur0904 profile image
Ankur Singh •

Yes, sure.

Collapse
 
dotallio profile image
Dotallio •

So many practical lsof examples here, love how you covered network ports and biggest files too! Ever used lsof to debug stubborn locked files in production?

Collapse
 
ankur0904 profile image
Ankur Singh •

Yes, sometimes. What about you?

Collapse
 
nathan_tarbert profile image
Nathan Tarbert •

really solid walkthrough, i always pick up something new messing around in the terminal. ever run into situations where lsof saved you a ton of time troubleshooting?

Collapse
 
ankur0904 profile image
Ankur Singh •

Thanks for the compliment. Yes exactly lsof is life saver.