15 Linux lsof Command Examples (Identify Open Files).pdf
16
7/29/13 15 Linux lsof Command Examples (Identify Open Files) www.thegeekstuff.com/2012/08/lsof-command-examples/ 1/16 57 Like 28 Home About Free eBook Archives Best of the Blog Contact 15 Linux lsof Command Examples (Identify Open Files) by Lakshmanan Ganapathy on August 29, 2012 Tweet Tweet 61 lsof stands for List Open Files. It is easy to remember lsof command if you think of it as “ls + of”, where ls stands for list, and of stands for open files. It is a command line utility which is used to list the information about the files that are opened by various processes. In unix, everything is a file, ( pipes, sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files. 1. Introduction to lsof
-
Upload
victor-l-wamukoya -
Category
Documents
-
view
105 -
download
6
description
examples of lsof
Transcript of 15 Linux lsof Command Examples (Identify Open Files).pdf
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 1/16
57 Like 28
HomeAboutFree eBook
ArchivesBest of the BlogContact
15 Linux lsof Command Examples (Identify Open Files)
by Lakshmanan Ganapathy on August 29, 2012
TweetTweet 61
lsof stands for List Open Files.
It is easy to remember lsof command if you think of it as “ls + of”, where ls stands for list, and of stands for open files.
It is a command line utility which is used to list the information about the files that are opened by various processes. In unix, everything is a file, ( pipes,sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files.
1. Introduction to lsof
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 2/16
Simply typing lsof will provide a list of all open files belonging to all active processes.
# lsof
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEinit 1 root cwd DIR 8,1 4096 2 /init 1 root txt REG 8,1 124704 917562 /sbin/initinit 1 root 0u CHR 1,3 0t0 4369 /dev/nullinit 1 root 1u CHR 1,3 0t0 4369 /dev/nullinit 1 root 2u CHR 1,3 0t0 4369 /dev/nullinit 1 root 3r FIFO 0,8 0t0 6323 pipe...
By default One file per line is displayed. Most of the columns are self explanatory. We will explain the details about couple of cryptic columns (FD andTYPE).
FD – Represents the file descriptor. Some of the values of FDs are,
cwd – Current Working Directorytxt – Text file
mem – Memory mapped filemmap – Memory mapped device
NUMBER – Represent the actual file descriptor. The character after the number i.e ’1u’, represents the mode in which the file is opened. r for
read, w for write, u for read and write.
TYPE – Specifies the type of the file. Some of the values of TYPEs are,
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 3/16
REG – Regular File
DIR – DirectoryFIFO – First In First OutCHR – Character special file
For a complete list of FD & TYPE, refer man lsof.
2. List processes which opened a specific file
You can list only the processes which opened a specific file, by providing the filename as arguments.
# lsof /var/log/syslog
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMErsyslogd 488 syslog 1w REG 8,1 1151 268940 /var/log/syslog
3. List opened files under a directory
You can list the processes which opened files under a specified directory using ‘+D’ option. +D will recurse the sub directories also. If you don’t wantlsof to recurse, then use ‘+d’ option.
# lsof +D /var/log/
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 4/16
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMErsyslogd 488 syslog 1w REG 8,1 1151 268940 /var/log/syslogrsyslogd 488 syslog 2w REG 8,1 2405 269616 /var/log/auth.logconsole-k 144 root 9w REG 8,1 10871 269369 /var/log/ConsoleKit/history
4. List opened files based on process names starting with
You can list the files opened by process names starting with a string, using ‘-c’ option. -c followed by the process name will list the files opened by theprocess starting with that processes name. You can give multiple -c switch on a single command line.
# lsof -c ssh -c init
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEinit 1 root txt REG 8,1 124704 917562 /sbin/initinit 1 root mem REG 8,1 1434180 1442625 /lib/i386-linux-gnu/libc-2.13.soinit 1 root mem REG 8,1 30684 1442694 /lib/i386-linux-gnu/librt-2.13.so...ssh-agent 1528 lakshmanan 1u CHR 1,3 0t0 4369 /dev/nullssh-agent 1528 lakshmanan 2u CHR 1,3 0t0 4369 /dev/nullssh-agent 1528 lakshmanan 3u unix 0xdf70e240 0t0 10464 /tmp/ssh-sUymKXxw1495/agent.1495
5. List processes using a mount point
Sometime when we try to umount a directory, the system will say “Device or Resource Busy” error. So we need to find out what are all the processesusing the mount point and kill those processes to umount the directory. By using lsof we can find those processes.
# lsof /home
The following will also work.
# lsof +D /home/
6. List files opened by a specific user
In order to find the list of files opened by a specific users, use ‘-u’ option.
# lsof -u lakshmanan
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 5/16
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
update-no 1892 lakshmanan 20r FIFO 0,8 0t0 14536 pipeupdate-no 1892 lakshmanan 21w FIFO 0,8 0t0 14536 pipebash 1995 lakshmanan cwd DIR 8,1 4096 393218 /home/lakshmanan
Sometimes you may want to list files opened by all users, expect some 1 or 2. In that case you can use the ‘^’ to exclude only the particular user as
follows
# lsof -u lakshmanan
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMErtkit-dae 1380 rtkit 7u 0000 0,9 0 4360 anon_inodeudisks-da 1584 root cwd DIR 8,1 4096 2 /
The above command listed all the files opened by all users, expect user ‘lakshmanan’.
7. List all open files by a specific process
You can list all the files opened by a specific process using ‘-p’ option. It will be helpful sometimes to get more information about a specific process.
# lsof -p 1753
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEbash 1753 lakshmanan cwd DIR 8,1 4096 393571 /home/lakshmanan/test.txtbash 1753 lakshmanan rtd DIR 8,1 4096 2 /bash 1753 lakshmanan 255u CHR 136,0 0t0 3 /dev/pts/0...
8. Kill all process that belongs to a particular user
When you want to kill all the processes which has files opened by a specific user, you can use ‘-t’ option to list output only the process id of theprocess, and pass it to kill as follows
# kill -9 lsof -t -u lakshmanan
The above command will kill all process belonging to user ‘lakshmanan’, which has files opened.
Similarly you can also use ‘-t’ in many ways. For example, to list process id of a process which opened /var/log/syslog can be done by
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 6/16
# lsof -t /var/log/syslog
489
Talking about kill, did you know that there are 4 Ways to Kill a Process?
9. Combine more list options using OR/AND
By default when you use more than one list option in lsof, they will be ORed. For example,
# lsof -u lakshmanan -c init
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEinit 1 root cwd DIR 8,1 4096 2 /init 1 root txt REG 8,1 124704 917562 /sbin/initbash 1995 lakshmanan 2u CHR 136,2 0t0 5 /dev/pts/2bash 1995 lakshmanan 255u CHR 136,2 0t0 5 /dev/pts/2...
The above command uses two list options, ‘-u’ and ‘-c’. So the command will list process belongs to user ‘lakshmanan’ as well as process namestarts with ‘init’.
But when you want to list a process belongs to user ‘lakshmanan’ and the process name starts with ‘init’, you can use ‘-a’ option.
# lsof -u lakshmanan -c init -a
The above command will not output anything, because there is no such process named ‘init’ belonging to user ‘lakshmanan’.
10. Execute lsof in repeat mode
lsof also support Repeat mode. It will first list files based on the given parameters, and delay for specified seconds and again list files based on thegiven parameters. It can be interrupted by a signal.
Repeat mode can be enabled by using ‘-r’ or ‘+r’. If ‘+r’ is used then, the repeat mode will end when no open files are found. ‘-r’ will continue tolist,delay,list until a interrupt is given irrespective of files are opened or not.
Each cycle output will be separated by using ‘=======’. You also also specify the time delay as ‘-r’ | ‘+r’.
# lsof -u lakshmanan -c init -a -r5
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 7/16
==============COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEinita.sh 2971 lakshmanan cwd DIR 8,1 4096 393218 /home/lakshmananinita.sh 2971 lakshmanan rtd DIR 8,1 4096 2 /inita.sh 2971 lakshmanan txt REG 8,1 83848 524315 /bin/dashinita.sh 2971 lakshmanan mem REG 8,1 1434180 1442625 /lib/i386-linux-gnu/libc-2.13.soinita.sh 2971 lakshmanan mem REG 8,1 117960 1442612 /lib/i386-linux-gnu/ld-2.13.soinita.sh 2971 lakshmanan 0u CHR 136,4 0t0 7 /dev/pts/4inita.sh 2971 lakshmanan 1u CHR 136,4 0t0 7 /dev/pts/4inita.sh 2971 lakshmanan 2u CHR 136,4 0t0 7 /dev/pts/4inita.sh 2971 lakshmanan 10r REG 8,1 20 393578 /home/lakshmanan/inita.sh=======
In the above output, for the first 5 seconds, there is no output. After that a script named “inita.sh” is started, and it list the output.
Finding Network Connection
Network connections are also files. So we can find information about them by using lsof.
11. List all network connections
You can list all the network connections opened by using ‘-i’ option.
# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEavahi-dae 515 avahi 13u IPv4 6848 0t0 UDP *:mdnsavahi-dae 515 avahi 16u IPv6 6851 0t0 UDP *:52060cupsd 1075 root 5u IPv6 22512 0t0 TCP ip6-localhost:ipp (LISTEN)
You can also use ‘-i4′ or ‘-i6′ to list only ‘IPV4′ or ‘IPV6‘ respectively.
12. List all network files in use by a specific process
You can list all the network files which is being used by a process as follows
# lsof -i -a -p 234
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 8/16
57 TweetTweet 61 Like 28
You can also use the following
# lsof -i -a -c ssh
The above command will list the network files opened by the processes starting with ssh.
13. List processes which are listening on a particular port
You can list the processes which are listening on a particular port by using ‘-i’ with ‘:’ as follows
# lsof -i :25
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAMEexim4 2541 Debian-exim 3u IPv4 8677 TCP localhost:smtp (LISTEN)
14. List all TCP or UDP connections
You can list all the TCP or UDP connections by specifying the protocol using ‘-i’.
# lsof -i tcp; lsof -i udp;
15. List all Network File System ( NFS ) files
You can list all the NFS files by using ‘-N’ option. The following lsof command will list all NFS files used by user ‘lakshmanan’.
# lsof -N -u lakshmanan -a
> Add your comment
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 9/16
Linux provides several powerful administrative tools and utilities which will help you to manage your systems
effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic
administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linuxsystem administrator.
Get the Linux Sysadmin Course Now!
If you enjoyed this article, you might also like..
1. 50 Linux Sysadmin Tutorials2. 50 Most Frequently Used Linux Commands (With Examples)
3. Top 25 Best Linux Performance Monitoring and Debugging Tools
4. Mommy, I found it! – 15 Practical Linux Find Command Examples5. Linux 101 Hacks 2nd Edition eBook
Awk Introduction – 7 Awk Print ExamplesAdvanced Sed Substitution Examples
8 Essential Vim Editor Navigation Fundamentals
25 Most Frequently Used Linux IPTables Rules ExamplesTurbocharge PuTTY with 12 Powerful Add-Ons
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 10/16
Tags: AIX lsof, lsof for Windows, lsof Port
{ 11 comments… read them below or add one }
1 Srinivas August 29, 2012 at 10:57 am
Hi
It is good article. I knew most of the lsof option but still learned few things from this article. Particularly +d option and and repeat mode.
Very highly informative article.
Would it be possible to write about complex one liners which gives much more information? Like using lsof command to generate top 10 filesopened processes etc.
Srinivas
2 raghavan August 29, 2012 at 3:29 pm
Excellent tutorial again.
May be you could write a second part going in detail about the various columns (FD, TYPE, DEVICE, SIZE/OFF).
I generally do prefer netstat over lsof for information on networking.
3 Manojkumar August 30, 2012 at 12:08 am
Nice to recall the options once again.
4 Ankit August 30, 2012 at 1:54 am
Good tutorial, i just encountered the need to use the command today and here I found the good tutorial. Thanks.
5 niraj August 30, 2012 at 2:33 am
informative and nice article .
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 11/16
6 Adorn August 30, 2012 at 10:18 pm
Very good tutorial..!Keep on posting..
7 Ethan August 31, 2012 at 6:08 pm
very good article. Linux belong to all of us interested in it.
8 Mark September 2, 2012 at 7:14 am
This is good information. On larger systems where root or oracle have lots of files open, I use these commands to properly tune my systemsulimits. Thanks. **Read more on ulimits before proceeding.
9 Jalal Hajigholamali September 5, 2012 at 9:45 pm
Hi,
Very good article, thanks a lot…
10 Leenus December 14, 2012 at 10:48 pm
Nice article, thanks a lot for the author of this book.
11 Dhamudba February 14, 2013 at 12:54 pm
Thanks…Its useful.
Leave a Comment
Name
Website
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 12/16
Notify me of followup comments via e-mail
Submit
Previous post: C Linked List Data Structure Explained with an Example C Program
Next post: Linux uname Command Examples (Get Kernel version, release, hostname, etc)
Search
>Email >RSS >Twitter >Facebook
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 13/16
COURSE
Linux Sysadmin CentOS 6 Course - Master the Tools, Configure it Right, and be Lazy
EBOOKS
Linux 101 Hacks 2nd Edition eBook - Practical Examples to Build a Strong Foundation in Linux
Bash 101 Hacks eBook - Take Control of Your Bash Command Line and Shell ScriptingSed and Awk 101 Hacks eBook - Enhance Your UNIX / Linux Life with Sed and Awk
Vim 101 Hacks eBook - Practical Examples for Becoming Fast and Productive in Vim EditorNagios Core 3 eBook - Monitor Everything, Be Proactive, and Sleep Well
POPULAR POSTS
12 Amazing and Essential Linux Books To Enrich Your Brain and Library
50 UNIX / Linux Sysadmin Tutorials50 Most Frequently Used UNIX / Linux Commands (With Examples)
How To Be Productive and Get Things Done Using GTD
30 Things To Do When you are Bored and have a ComputerLinux Directory Structure (File System Structure) Explained with Examples
Linux Crontab: 15 Awesome Cron Job ExamplesGet a Grip on the Grep! – 15 Practical Grep Command Examples
Unix LS Command: 15 Practical Examples
15 Examples To Master Linux Command Line HistoryTop 10 Open Source Bug Tracking System
Vi and Vim Macro Tutorial: How To Record and PlayMommy, I found it! -- 15 Practical Linux Find Command Examples
15 Awesome Gmail Tips and Tricks15 Awesome Google Search Tips and Tricks
RAID 0, RAID 1, RAID 5, RAID 10 Explained with Diagrams
Can You Top This? 15 Practical Linux Top Command ExamplesTop 5 Best System Monitoring Tools
Top 5 Best Linux OS DistributionsHow To Monitor Remote Linux Host using Nagios 3.0
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 14/16
Awk Introduction Tutorial – 7 Awk Print Examples
How to Backup Linux? 15 rsync Command ExamplesThe Ultimate Wget Download Guide With 15 Awesome Examples
Top 5 Best Linux Text EditorsPacket Analyzer: 15 TCPDUMP Command Examples
The Ultimate Bash Array Tutorial with 15 Examples
3 Steps to Perform SSH Login Without Password Using ssh-keygen & ssh-copy-idUnix Sed Tutorial: Advanced Sed Substitution Examples
UNIX / Linux: 10 Netstat Command ExamplesThe Ultimate Guide for Creating Strong Passwords
6 Steps to Secure Your Home Wireless NetworkTurbocharge PuTTY with 12 Powerful Add-Ons
CATEGORIES
LinuxVim
Sed
AwkBash
NagiosOpenSSH
IPTablesApache
MySQL
PerlGoogle
UbuntuPostgreSQL
Hello WorldC Programming
C++ Programming
DELLOracle
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 15/16
VMware
About The Geek Stuff
My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux,database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about
Ramesh Natarajan and the blog.
Support Us
Support this blog by purchasing one of my ebooks.
Bash 101 Hacks eBook
Sed and Awk 101 Hacks eBook
Vim 101 Hacks eBook
Nagios Core 3 eBook
Contact Us
Email Me : Use this Contact Form to get in touch me with your comments, questions or suggestions about this site. You can also simply drop
me a line to say hello!.
Follow us on Twitter
7/29/13 15 Linux lsof Command Examples (Identify Open Files)
www.thegeekstuff.com/2012/08/lsof-command-examples/ 16/16
Become a fan on Facebook
Copyright © 2008–2013 Ramesh Natarajan. All rights reserved | Terms of Service | Advertise
