How to use lsof command effectively in linux?

The “lsof” (list open files) command in Linux is a powerful tool that provides information about files and processes that are currently opened by the system. Here are several ways you can use the “lsof” command effectively in linux.

Prerequisites:

1. Ensure lsof package is installed on your system by running below command:

lsof

or

yum list installed | grep -I lsof

If you are getting “command not found” message, install the lsog package using below command.

sudo yum install lsof

Once, the lsof installed, verify using the below command.

lsof --version

Here are the different ways which you can use “lsof” command effectively.

1. List all open files and processes:

sudo lsof

This command lists all open files and the processes that opened them.

2. List processes using a specific file:

lsof /path/to/file

Replace “/path/to/file” with the actual path to the file you want to check. This command shows the processes that have the specified file open.

3. List processes using a specific port:

sudo lsof -i :port_number

Replace “port_number” with the actual port number. This command displays the processes that are using the specified port.

4. List processes by a specific user:

sudo lsof -u username

Replace “username” with the specific username. This command shows the processes opened by the specified user.

5. List network connections:

sudo lsof -i

This command displays all network connections and listening ports.

6. List files opened by a specific command or process ID (PID):

lsof -c command_name

Replace “command_name” with the name of the command you want to check.

lsof -p PID

Replace “PID” with the process ID you want to inspect.

7. List deleted files that are still open:

lsof +L1

This command shows the information about files that have been unlinked (deleted) but are still being used by active processes.

8. List files opened by a specific user on a specific filesystem:

sudo lsof -u username -N -a +D /path/to/filesystem

Replace “username” with the specific username and “/path/to/filesystem” with the filesystem path. This command displays files opened by the specified user on the specified filesystem.

9. List open files by a specific process and user:

sudo lsof -u username -p PID

Replace “username” with the specific username and “PID” with the process ID you want to inspect. This command shows files opened by the specified user within the specified process.

Remember, using “lsof” might require superuser privileges for certain operations, so you might need to run these commands with “sudo” to get complete information about all processes and files.