Example of 10 lsof command lines

1. Use the lsof command line to list all open files

# lsof 

This is a very long list, including open files and networks

The above screen contains many columns, such as PID, user, FD, and TYPE.

FD - File descriptor

The FD column contains such values.

cwd - Current working directorytxt - Text filemem - Memory Mapped filemmap - Memory Mapped deviceNumber - It represent the actual file descriptor. For example, 0u, 1w and 3r

R indicates read, w indicates write, and u indicates read/write.

Type indicates the file Type, for example:

>REG - Regular file >DIR - Directory>CHR - Character special file>FIFO - First in first out 

2. List files opened by a user

# lsof -u user_name 

Example:

# lsof -u crybitCOMMAND   PID   USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAMEsshd    29609 crybit  cwd    DIR            144,233     4096  117711421 /sshd    29609 crybit  rtd    DIR            144,233     4096  117711421 /sshd    29609 crybit  txt    REG            144,233   409488  119020186 /usr/sbin/sshdsshd    29609 crybit  mem    REG            144,241          2443001619 (deleted)/dev/zero (stat: No such file or directory)sshd    29609 crybit  mem    REG               8,37           119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119021984 /lib64/security/pam_succeed_if.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119022000 /lib64/security/pam_limits.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119021960 /lib64/security/pam_keyinit.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119021972 /lib64/security/pam_cracklib.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119021987 /lib64/security/pam_nologin.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119021988 /lib64/security/pam_deny.so (path dev=144,233)sshd    29609 crybit  mem    REG               8,37           119019223 /usr/lib64/libcrack.so.2.8.0 (path dev=144,233).......... 

3. List processes running on a port

# lsof -i :port_number 

Example:

# lsof -i :22COMMAND   PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAMEsshd      769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)sshd      769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN) 

# lsof -i :3306COMMAND   PID  USER   FD   TYPE     DEVICE SIZE/OFF NODE NAMEmysqld  11106 mysql   10u  IPv4 2340975114      0t0  TCP *:mysql (LISTEN) 

4. Only open files using IPv4 are listed.

# lsof -i 4 - For IPv4 

Example:

# lsof -i 4COMMAND     PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAMEsshd        769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)named      8362  named   20u  IPv4 2334751017      0t0  TCP localhost.localdomain:domain (LISTEN)named      8362  named   21u  IPv4 2334751019      0t0  TCP crybit.com:domain (LISTEN)named      8362  named   22u  IPv4 2334751021      0t0  TCP localhost.localdomain:rndc (LISTEN)named      8362  named  512u  IPv4 2334751016      0t0  UDP localhost.localdomain:domain named      8362  named  513u  IPv4 2334751018      0t0  UDP crybit.com:domain tcpserver  9975   root    3u  IPv4 2335487959      0t0  TCP *:pop3 (LISTEN)tcpserver  9978   root    3u  IPv4 2335487967      0t0  TCP *:pop3s (LISTEN)tcpserver  9983   root    3u  IPv4 2335487997      0t0  TCP *:imap (LISTEN)tcpserver  9987   root    3u  IPv4 2335488014      0t0  TCP *:imaps (LISTEN)xinetd    10413   root    5u  IPv4 2336070983      0t0  TCP *:ftp (LISTEN)xinetd    10413   root    6u  IPv4 2336070984      0t0  TCP *:smtp (LISTEN)mysqld    11106  mysql   10u  IPv4 2340975114      0t0  TCP *:mysql (LISTEN) 

# lsof -i 6 

Example:

# lsof -i 6COMMAND   PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAMEsshd      769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)named    8362  named   23u  IPv6 2334751024      0t0  TCP localhost.localdomain:rndc (LISTEN)httpd   29241   root    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)httpd   29241   root    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)httpd   29243 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)httpd   29243 apache    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)httpd   29244 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)httpd   29244 apache    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)httpd   29245 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)httpd   29245 apache    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)httpd   29246 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN) 

5. list all processes with ports between 1 and 1024.

# lsof -i :1-1024 

Example:

# lsof -i :1-1024COMMAND     PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAMEsshd        769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)sshd        769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)named      8362  named   20u  IPv4 2334751017      0t0  TCP localhost.localdomain:domain (LISTEN)named      8362  named   21u  IPv4 2334751019      0t0  TCP crybit.com:domain (LISTEN)named      8362  named   22u  IPv4 2334751021      0t0  TCP localhost.localdomain:rndc (LISTEN)named      8362  named   23u  IPv6 2334751024      0t0  TCP localhost.localdomain:rndc (LISTEN)tcpserver  9975   root    3u  IPv4 2335487959      0t0  TCP *:pop3 (LISTEN)tcpserver  9978   root    3u  IPv4 2335487967      0t0  TCP *:pop3s (LISTEN)tcpserver  9983   root    3u  IPv4 2335487997      0t0  TCP *:imap (LISTEN)tcpserver  9987   root    3u  IPv4 2335488014      0t0  TCP *:imaps (LISTEN)xinetd    10413   root    5u  IPv4 2336070983      0t0  TCP *:ftp (LISTEN)xinetd    10413   root    6u  IPv4 2336070984      0t0  TCP *:smtp (LISTEN)httpd     29241   root    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)httpd     29241   root    6u  IPv6 2439777211      0t0  TCP *:https (LISTEN)httpd     29243 apache    4u  IPv6 2439777206      0t0  TCP *:http (LISTEN)........ 

6. List open files by process id

# lsof -p PID 

Example:

# lsof -p 11106COMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAMEmysqld  11106 mysql  cwd    DIR            144,233     4096  119025114 /var/lib/mysqlmysqld  11106 mysql  rtd    DIR            144,233     4096  117711421 /mysqld  11106 mysql  txt    REG            144,233  9484782  119025094 /usr/libexec/mysqldmysqld  11106 mysql  mem    REG               8,37           119025094 /usr/libexec/mysqld (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119021830 /lib64/libnss_files-2.5.so (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119021841 /lib64/libsepol.so.1 (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119021801 /lib64/libselinux.so.1 (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119021785 /lib64/libresolv-2.5.so (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119021920 /lib64/libkeyutils-1.2.so (path dev=144,233)mysqld  11106 mysql  mem    REG               8,37           119017006 /usr/lib64/libkrb5support.so.0.1 (path dev=144,233)........ 

7. Kill all active processes of a user

# killall -9 `lsof -t -u username` 

8. List opened files in a directory

# lsof +D path_of_the_directory 

Example:

# lsof +D /var/log/COMMAND     PID   USER   FD   TYPE  DEVICE SIZE/OFF      NODE NAMEsyslogd    9729   root    1w   REG 144,233        0 119019158 /var/log/kernelsyslogd    9729   root    2w   REG 144,233   350722 119021699 /var/log/messagessyslogd    9729   root    3w   REG 144,233   591577 119019159 /var/log/securesyslogd    9729   root    4w   REG 144,233   591577 119019159 /var/log/secure 

9. List open files by process name

# lsof -c process_name 

Example:

# lsof -c sshCOMMAND     PID USER   FD   TYPE     DEVICE SIZE/OFF    NODE NAMEsshd        483 root  cwd    DIR        8,9     4096       2 /sshd        483 root  rtd    DIR        8,9     4096       2 /sshd        483 root  txt    REG        8,9   523488 1193409 /usr/sbin/sshd 

10. list all network connections

# lsof -i 

This command lists all listeners and established network connections.
Example:

# lsof -iCOMMAND     PID   USER   FD   TYPE     DEVICE SIZE/OFF NODE NAMEsshd        769   root    3u  IPv6 2281738844      0t0  TCP *:ssh (LISTEN)sshd        769   root    4u  IPv4 2281738846      0t0  TCP *:ssh (LISTEN)named      8362  named   20u  IPv4 2334751017      0t0  TCP localhost.localdomain:domain (LISTEN)named      8362  named   21u  IPv4 2334751019      0t0  TCP crybit.com:domain (LISTEN)named      8362  named   22u  IPv4 2334751021      0t0  TCP localhost.localdomain:rndc (LISTEN)named      8362  named   23u  IPv6 2334751024      0t0  TCP localhost.localdomain:rndc (LISTEN)named      8362  named  512u  IPv4 2334751016      0t0  UDP localhost.localdomain:domain

That's all!