lsof(1)
List open files and the processes that opened them.
Synopsis
lsof [OPTION]... [FILE|PROCESS]...Description
lsof displays information about files opened by processes. It can show which files, sockets, pipes, and devices are in use by which processes, making it invaluable for troubleshooting resource conflicts, finding who's using a file, and understanding system activity.
Without arguments, lsof lists all open files on the system. You can filter by process ID, user, filename, or network connections to narrow results.
Common options
| Flag | What it does |
|---|---|
-p PID | List files opened by process ID (comma-separated for multiple PIDs) |
-u USER | List files opened by a specific user |
-i | List all network connections (IPv4 and IPv6) |
-i :PORT | List processes using a specific port (e.g., -i :8080) |
-n | Suppress hostname lookup (faster output) |
-P | Suppress port name lookup; show numeric port instead |
-a | AND together conditions (default is OR) |
-c COMMAND | List files opened by processes matching command name |
-d FD | List files matching file descriptor (e.g., -d 1-3 for stdin/stdout/stderr) |
-t | Output only process IDs (useful for piping to kill) |
Examples
Show first 20 open files system-wide (may require root for full output)
lsof | head -20List all files opened by process with PID 1234
lsof -p 1234Show which process is listening on port 8080
lsof -i :8080List all TCP connections with numeric IP addresses and ports
lsof -i TCP -n -PFind which process(es) have the log file open
lsof /var/log/app.logShow network connections opened by the apache user
lsof -u apache -a -iList all files opened by processes named nginx
lsof -c nginxGet unique file descriptors used by all MySQL processes
lsof -p $(pgrep mysql) -t | sort -u