List open files

One of the coolest and best tools that I use at work on a regular basis for all things systems administration is LSOF, or “list open files”. lsof lists information about files opened by a process. It can also list any opened network communication that said process might have. I use it like its going out style at work. Things like diagnosing network traffic too seeing who or what is hogging up all the resources on a specific port or range of ports and or files. Believe me, it has many uses!

There are tons of options to lsof so for the all the details, check out the maintainers” website or if your system has lsof already installed, check out the man page. Anyway, here are the most common options that I use along with a very brief explanation of what it does. For a more extensive set of examples, documented more fully, see the 00QUICKSTART file of the lsof distribution.

Anyway, on to the nerdy examples:

• To list all open files, use:
  

  $ lsof

• To see who is using vim, use;
  

  $ lsof /path/to/vim

• To specify terse output with PID’s only and no header – e.g., so that the output may be piped to kill(1), use:
  

  $ lsof -t

• To list all open files in use by the process whose PID is 1234, use:
  

  $ lsof -p 1234

• To list all open files in use by the process whos NAME is sendmail, use:
  

  $ lsof -c sendmail

• To see what files are being accessed all users other than root, use:
  

  $ lsof -u ^root

• To see what TCP processes are talking on port 80, use:
  

  $ lsof -i TCP:80

• To list all files using any protocol on ports 21, 22, or 23 on host example.com, use:
  

  $ lsof -i @example.com:21-23

• Alternatively, to list all files using any protocol on any port on example.com, use:
  

  $ lsof -i @example.com

• To list all open files on device /dev/sda5, use:
  

  $ lsof /dev/sda5

• To search for all open instances of the directory /home/joeuser/ and all the files and directories it contains to its complete depth, use:
  

  $ lsof +D /home/joeuser/

• To shows open files that have been deleted, use:
  

  $ lsof +L1

There you have it. Obviously, you can pipe the output of lsof to any number of utilities to further enhance or filter its output. Enjoy!