{"id":12418,"date":"2019-03-26T23:30:29","date_gmt":"2019-03-26T23:30:29","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=12418"},"modified":"2019-03-26T23:30:29","modified_gmt":"2019-03-26T23:30:29","slug":"10-lsof-command-examples-in-linux","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/03\/26\/10-lsof-command-examples-in-linux\/","title":{"rendered":"10 lsof Command Examples in Linux"},"content":{"rendered":"

This is our on-going series of Linux commands and in this article we are going to review\u00a0lsof<\/strong>\u00a0command with practical examples.\u00a0lsof<\/strong>\u00a0meaning\u00a0\u2018LiSt Open Files\u2019<\/strong>\u00a0is used to find out which files are open by which process. As we all know\u00a0Linux\/Unix<\/strong>\u00a0considers everything as a files (pipes<\/strong>,\u00a0sockets<\/strong>,\u00a0directories<\/strong>,\u00a0devices<\/strong>\u00a0etc). One of the reason to use\u00a0lsof<\/strong>\u00a0command is when a disk cannot be unmounted as it says the files are being used. With the help of this command we can easily identify the files which are in use.<\/p>\n

\n

\"lsof<\/a><\/p>\n

10 Linux lsof Command Examples<\/p>\n<\/div>\n

1. List all Open Files with lsof Command<\/h4>\n

In the below example, it will show long listing of open files some of them are extracted for better understanding which displays the columns like\u00a0Command<\/strong>,\u00a0PID<\/strong>,\u00a0USER<\/strong>,\u00a0FD<\/strong>,\u00a0TYPE<\/strong>\u00a0etc.<\/p>\n

# lsof<\/strong>\r\n\r\nCOMMAND    PID      USER   FD      TYPE     DEVICE  SIZE\/OFF       NODE NAME\r\ninit         1      root  cwd<\/strong>      DIR<\/strong>      253,0      4096          2 \/\r\ninit         1      root  rtd<\/strong>      DIR<\/strong>      253,0      4096          2 \/\r\ninit         1      root  txt<\/strong>      REG<\/strong>      253,0    145180     147164 \/sbin\/init\r\ninit         1      root  mem<\/strong>      REG<\/strong>      253,0   1889704     190149 \/lib\/libc-2.12.so\r\ninit         1      root   0u      CHR<\/strong>        1,3       0t0       3764 \/dev\/null\r\ninit         1      root   1u<\/strong>      CHR<\/strong>        1,3       0t0       3764 \/dev\/null\r\ninit         1      root   2u      CHR<\/strong>        1,3       0t0       3764 \/dev\/null\r\ninit         1      root   3r     FIFO<\/strong>        0,8       0t0       8449 pipe\r\ninit         1      root   4w     FIFO<\/strong>       0,8       0t0       8449 pipe\r\ninit         1      root   5r      DIR<\/strong>       0,10         0          1 inotify\r\ninit         1      root   6r      DIR<\/strong>       0,10         0          1 inotify\r\ninit         1      root   7u     unix 0xc1513880       0t0       8450 socket<\/pre>\n
Sections and it\u2019s values are self-explanatory. However, we\u2019ll review\u00a0FD & TYPE<\/strong>\u00a0columns more precisely.<\/p>\n
FD<\/strong>\u00a0\u2013 stands for File descriptor and may seen some of the values as:<\/p>\n
    \n
  1. cwd<\/strong>\u00a0current working directory<\/li>\n
  2. rtd<\/strong>\u00a0root directory<\/li>\n
  3. txt<\/strong>\u00a0program text (code and data)<\/li>\n
  4. mem<\/strong>\u00a0memory-mapped file<\/li>\n<\/ol>\n
    Also in\u00a0FD<\/strong>\u00a0column numbers like\u00a01u<\/strong>\u00a0is actual file descriptor and followed by u,r,w of it\u2019s mode as:<\/p>\n
      \n
    1. r<\/strong>\u00a0for read access.<\/li>\n
    2. w<\/strong>\u00a0for write access.<\/li>\n
    3. u<\/strong>\u00a0for read and write access.<\/li>\n<\/ol>\n
      TYPE<\/strong>\u00a0\u2013 of files and it\u2019s identification.<\/p>\n
        \n
      1. DIR<\/strong>\u00a0\u2013 Directory<\/li>\n
      2. REG<\/strong>\u00a0\u2013 Regular file<\/li>\n
      3. CHR<\/strong>\u00a0\u2013 Character special file.<\/li>\n
      4. FIFO<\/strong>\u00a0\u2013 First In First Out<\/li>\n<\/ol>\n
        2. List User Specific Opened Files<\/h4>\n
        The below command will display the list of all opened files of user\u00a0tecmint<\/strong>.<\/p>\n
        # lsof -u tecmint<\/strong>\r\n\r\nCOMMAND  PID    USER   FD   TYPE     DEVICE SIZE\/OFF   NODE NAME\r\nsshd    1838 tecmint  cwd    DIR      253,0     4096      2 \/\r\nsshd    1838 tecmint  rtd    DIR      253,0     4096      2 \/\r\nsshd    1838 tecmint  txt    REG      253,0   532336 188129 \/usr\/sbin\/sshd\r\nsshd    1838 tecmint  mem    REG      253,0    19784 190237 \/lib\/libdl-2.12.so\r\nsshd    1838 tecmint  mem    REG      253,0   122436 190247 \/lib\/libselinux.so.1\r\nsshd    1838 tecmint  mem    REG      253,0   255968 190256 \/lib\/libgssapi_krb5.so.2.2\r\nsshd    1838 tecmint  mem    REG      253,0   874580 190255 \/lib\/libkrb5.so.3.3<\/pre>\n
        3. Find Processes running on Specific Port<\/h4>\n
        To find out all the running process of specific port, just use the following command with option\u00a0-i<\/strong>. The below example will list all running process of port\u00a022<\/strong>.<\/p>\n
        # lsof -i TCP:22<\/strong>\r\n\r\nCOMMAND  PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nsshd    1471    root    3u  IPv4  12683      0t0  TCP *:ssh (LISTEN)\r\nsshd    1471    root    4u  IPv6  12685      0t0  TCP *:ssh (LISTEN)<\/pre>\n
        4. List Only IPv4 & IPv6 Open Files<\/h4>\n
        In below example shows only\u00a0IPv4<\/strong>\u00a0and\u00a0IPv6<\/strong>\u00a0network files open with separate commands.<\/p>\n
        # lsof -i 4<\/strong>\r\n\r\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nrpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc\r\nrpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954\r\nrpcbind   1203     rpc    8u  IPv4  11331      0t0  TCP *:sunrpc (LISTEN)\r\navahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns\r\navahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600\r\n\r\n# lsof -i 6<\/strong>\r\n\r\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nrpcbind   1203     rpc    9u  IPv6  11333      0t0  UDP *:sunrpc\r\nrpcbind   1203     rpc   10u  IPv6  11335      0t0  UDP *:954\r\nrpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\r\nrpc.statd 1277 rpcuser   10u  IPv6  11858      0t0  UDP *:55800\r\nrpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)\r\ncupsd     1346    root    6u  IPv6  12112      0t0  TCP localhost:ipp (LISTEN)<\/pre>\n
        5. List Open Files of TCP Port ranges 1-1024<\/h4>\n
        To list all the running process of open files of\u00a0TCP<\/strong>\u00a0Port ranges from\u00a01-1024<\/strong>.<\/p>\n
        # lsof -i TCP:1-1024<\/strong>\r\n\r\nCOMMAND  PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nrpcbind 1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\r\ncupsd   1346    root    7u  IPv4  12113      0t0  TCP localhost:ipp (LISTEN)\r\nsshd    1471    root    4u  IPv6  12685      0t0  TCP *:ssh (LISTEN)\r\nmaster  1551    root   13u  IPv6  12898      0t0  TCP localhost:smtp (LISTEN)\r\nsshd    1834    root    3r  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)\r\nsshd    1838 tecmint    3u  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)\r\nsshd    1871    root    3r  IPv4  15842      0t0  TCP 192.168.0.2:ssh->192.168.0.1:groove (ESTABLISHED)\r\nhttpd   1918    root    5u  IPv6  15991      0t0  TCP *:http (LISTEN)\r\nhttpd   1918    root    7u  IPv6  15995      0t0  TCP *:https (LISTEN)<\/pre>\n
        6. Exclude User with \u2018^\u2019 Character<\/h4>\n
        Here, we have excluded\u00a0root<\/strong>\u00a0user. You can exclude a particular user using\u00a0\u2018^\u2019<\/strong>\u00a0with command as shown above.<\/p>\n
        # lsof -i -u^root<\/strong>\r\n\r\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nrpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc\r\nrpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954\r\nrpcbind   1203     rpc    8u  IPv4  11331      0t0  TCP *:sunrpc (LISTEN)\r\nrpcbind   1203     rpc    9u  IPv6  11333      0t0  UDP *:sunrpc\r\nrpcbind   1203     rpc   10u  IPv6  11335      0t0  UDP *:954\r\nrpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\r\navahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns\r\navahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600\r\nrpc.statd 1277 rpcuser    5r  IPv4  11836      0t0  UDP *:soap-beep\r\nrpc.statd 1277 rpcuser    8u  IPv4  11850      0t0  UDP *:55146\r\nrpc.statd 1277 rpcuser    9u  IPv4  11854      0t0  TCP *:32981 (LISTEN)\r\nrpc.statd 1277 rpcuser   10u  IPv6  11858      0t0  UDP *:55800\r\nrpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)<\/pre>\n
        7. Find Out who\u2019s Looking What Files and Commands?<\/h4>\n
        Below example shows user\u00a0tecmint<\/strong>\u00a0is using command like\u00a0ping<\/strong>\u00a0and\u00a0\/etc<\/strong>\u00a0directory .<\/p>\n
        # lsof -i -u tecmint<\/strong>\r\n\r\nCOMMAND  PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nbash    1839 tecmint  cwd    DIR  253,0    12288   15 \/etc\r\nping    2525 tecmint  cwd    DIR  253,0    12288   15 \/etc<\/pre>\n
        8. List all Network Connections<\/h4>\n
        The following command with option\u00a0\u2018-i\u2019<\/strong>\u00a0shows the list of all network connections \u2018LISTENING & ESTABLISHED\u2019<\/strong>.<\/p>\n
        # lsof -i<\/strong>\r\n\r\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\r\nrpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc\r\nrpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954\r\nrpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\r\navahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns\r\navahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600\r\nrpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)\r\ncupsd     1346    root    6u  IPv6  12112      0t0  TCP localhost:ipp (LISTEN)\r\ncupsd     1346    root    7u  IPv4  12113      0t0  TCP localhost:ipp (LISTEN)\r\nsshd      1471    root    3u  IPv4  12683      0t0  TCP *:ssh (LISTEN)\r\nmaster    1551    root   12u  IPv4  12896      0t0  TCP localhost:smtp (LISTEN)\r\nmaster    1551    root   13u  IPv6  12898      0t0  TCP localhost:smtp (LISTEN)\r\nsshd      1834    root    3r  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)\r\nhttpd     1918    root    5u  IPv6  15991      0t0  TCP *:http (LISTEN)\r\nhttpd     1918    root    7u  IPv6  15995      0t0  TCP *:https (LISTEN)\r\nclock-app 2362   narad   21u  IPv4  22591      0t0  TCP 192.168.0.2:45284->www.gov.com:http (CLOSE_WAIT)\r\nchrome    2377   narad   61u  IPv4  25862      0t0  TCP 192.168.0.2:33358->maa03s04-in-f3.1e100.net:http (ESTABLISHED)\r\nchrome    2377   narad   80u  IPv4  25866      0t0  TCP 192.168.0.2:36405->bom03s01-in-f15.1e100.net:http (ESTABLISHED)<\/pre>\n
        9. Search by PID<\/h4>\n
        The below example only shows whose\u00a0PID<\/strong>\u00a0is\u00a01<\/strong>\u00a0[One<\/strong>].<\/p>\n
        # lsof -p 1<\/strong>\r\n\r\nCOMMAND PID USER   FD   TYPE     DEVICE SIZE\/OFF   NODE NAME\r\ninit      1 root  cwd    DIR      253,0     4096      2 \/\r\ninit      1 root  rtd    DIR      253,0     4096      2 \/\r\ninit      1 root  txt    REG      253,0   145180 147164 \/sbin\/init\r\ninit      1 root  mem    REG      253,0  1889704 190149 \/lib\/libc-2.12.so\r\ninit      1 root  mem    REG      253,0   142472 189970 \/lib\/ld-2.12.so<\/pre>\n
        10. Kill all Activity of Particular User<\/h4>\n
        Sometimes you may have to kill all the processes for a specific user. Below command will kills all the processes of\u00a0tecmint<\/strong>\u00a0user.<\/p>\n
        # kill -9 `lsof -t -u tecmint`<\/strong><\/pre>\n
        Note:<\/strong>\u00a0Here, it\u2019s not possible to give example of all available options, this guide is only to show how\u00a0lsof<\/strong>command can be use. You may refer man page of\u00a0lsof<\/strong>\u00a0command to know more about it. Please share it if you find this article is useful through our comment box below.<\/p>\n
        Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
        This is our on-going series of Linux commands and in this article we are going to review\u00a0lsof\u00a0command with practical examples.\u00a0lsof\u00a0meaning\u00a0\u2018LiSt Open Files\u2019\u00a0is used to find out which files are open by which process. As we all know\u00a0Linux\/Unix\u00a0considers everything as a files (pipes,\u00a0sockets,\u00a0directories,\u00a0devices\u00a0etc). One of the reason to use\u00a0lsof\u00a0command is when a disk cannot be unmounted … <\/p>\n
        Continue reading “10 lsof Command Examples in Linux”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-12418","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=12418"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12418\/revisions"}],"predecessor-version":[{"id":12420,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12418\/revisions\/12420"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=12418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=12418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=12418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}