---

lsof (list open files) shows information about files opened by processes. Lists open files, network connections, and file descriptors. Essential for debugging and system administration.

---

Basic Usage

• lsof - List all open files

• lsof -p PID - Files by process

• lsof -u user - Files by user

• lsof file - Processes using file

• lsof -i - Network connections

---

Process Selection

• -p PID - Process ID

• -p PID1,PID2 - Multiple PIDs

• -p ^PID - Exclude PID

• -c command - Command name

• -u user - Username

• -u ^user - Exclude user

---

File Selection

• lsof file - Specific file

• lsof +D directory - Directory

• lsof +d directory - Directory (non-recursive)

• -a - AND conditions

• -t - Show only PIDs

---

Network Options

• -i - All network connections

• -i TCP - TCP connections

• -i UDP - UDP connections

• -i :port - Specific port

• -i @host - Specific host

• -i @host:port - Host and port

• -i TCP:port - TCP on port

• -i UDP:port - UDP on port

---

Output Options

• -F - Field output

• -l - Show login names

• -n - No hostname resolution

• -P - No port name resolution

• -t - PID only

• -w - Suppress warnings

• -V - Version

---

Common Examples

Process Files

lsof -p 1234

Files opened by process.

User Files

lsof -u username

Files opened by user.

File Usage

lsof /path/to/file

Processes using file.

Network Connections

lsof -i

All network connections.

Port Usage

lsof -i :80

Process using port 80.

TCP Connections

lsof -i TCP

All TCP connections.

Specific Host

lsof -i @192.168.1.1

Connections to/from host.

Command Files

lsof -c firefox

Files opened by command.

Directory Files

lsof +D /var/log

Files in directory.

PID Only

lsof -t -i :80

Get PID using port.

---

Tips

• Use -i for network troubleshooting

• Use -t to get PIDs for scripts

• Use -n and -P for faster output

• Combine with kill to free resources

• Use -a to combine conditions

• Essential for debugging file locks

• Great for finding port conflicts

• Useful for security auditing