LSOF List Open Files

LSOF (List Open Files) Troubleshooting for Beginners

Table of Contents

1. 📝 What is lsof?
2. ⚡ Basic Commands
   • List All Open Files
   • Find Process Using a File
   • Find Process Using a Directory
   • Show Files Opened by Process
   • Show Files Opened by Process Name
   • Find Process Using a Port
   • Show Network Connections
   • Show TCP Connections Only
   • Show Listening Ports
3. 💡 Common Troubleshooting

• Find What's Using a Port
• Find What's Using a File
• Find All Files for a User
• Find Process Preventing Unmount

17. ⌨️ Quick Reference

---

📝 What is lsof?

• lsof (List Open Files) shows which processes have files open
• Displays files, directories, network connections, and devices in use
• Essential for troubleshooting "file in use" errors
• Usually requires root privileges for full information

What lsof can do:

• Find what process is using a file
• Show all files opened by a process
• Find processes using a port
• Display network connections
• Troubleshoot file locking issues

---

⚡ Basic Commands

List All Open Files

sudo lsof

What this does:

• Shows all open files for all processes
• Very long output
• Usually filtered or used with specific options

Note: May require sudo for full information.

---

Find Process Using a File

sudo lsof /path/to/file

What this does:

• Shows which process has the file open
• Useful for "file in use" errors
• Helps identify what's preventing file operations

Example:

sudo lsof /var/log/syslog

---

Find Process Using a Directory

sudo lsof +D /path/to/directory

What this does:

• Shows processes using files in a directory
• Recursive (includes subdirectories)
• Useful for unmounting filesystems

---

Show Files Opened by Process

sudo lsof -p 1234

What this does:

• Shows all files opened by process ID 1234
• Useful for seeing what a process is doing
• Helps identify resource usage

---

Show Files Opened by Process Name

sudo lsof -c processname

What this does:

• Shows files opened by processes matching the name
• Partial matches work
• Useful for finding all instances of a program

Example:

sudo lsof -c nginx

---

Find Process Using a Port

sudo lsof -i :80

What this does:

• Shows which process is using port 80
• Very useful for "port already in use" errors
• Alternative to ss or netstat

Example:

sudo lsof -i :22    # SSH port
sudo lsof -i :443   # HTTPS port

---

Show Network Connections

sudo lsof -i

What this does:

• Shows all network connections
• Displays TCP and UDP connections
• Similar to ss or netstat

---

Show TCP Connections Only

sudo lsof -iTCP

What this does:

• Shows only TCP connections
• Filters out UDP

---

Show Listening Ports

sudo lsof -iTCP -sTCP:LISTEN

What this does:

• Shows only listening TCP ports
• Useful for finding open services
• Similar to ss -tln

---

💡 Common Troubleshooting

Find What's Using a Port

sudo lsof -i :80

Shows process using port 80.

---

Find What's Using a File

sudo lsof /path/to/file

Shows process with file open.

---

Find All Files for a User

sudo lsof -u username

Shows all files opened by a user.

---

Find Process Preventing Unmount

sudo lsof +D /mnt

Shows what's preventing unmounting /mnt.

---

⌨️ Quick Reference

sudo lsof                          # All open files
sudo lsof /path/to/file            # File in use
sudo lsof +D /path/to/dir          # Directory in use
sudo lsof -p 1234                  # Process files
sudo lsof -c processname           # Process name
sudo lsof -i :80                   # Port in use
sudo lsof -iTCP -sTCP:LISTEN       # Listening ports
sudo lsof -u username               # User's files

---

For network connections, see the SS Network Troubleshooting Guide. For processes, see the PS Process Management Guide.