The lsof command, short for "list open files," is a powerful utility found in Unix-like operating systems such as Linux and macOS. Its primary function is to list all open files and the processes that have them open.
Here's a brief explanation about the lsof command:
lsof provides a comprehensive view of which files are currently in use by active processes on a system, including regular files, directories, network sockets, pipes, and devices. It is invaluable for troubleshooting, system monitoring, and gaining insights into the interactions between processes and the file system.
With lsof you can:
- Identify processes holding onto specific files or sockets, which can be particularly useful when trying to determine why a file cannot be deleted or why a network port is in use.
- List all files opened by a particular process, aiding in debugging or understanding the behavior of a program.
- Discover network connections established by processes, showing details such as source and destination IP addresses and port numbers.
- Monitor file system activity in real-time, useful for tracking down resource leaks or identifying unexpected file accesses.
The command offers a wide range of options to filter and customize its output, allowing users to tailor the information to their specific needs. While lsof is a powerful tool, it typically requires administrative privileges to access detailed information about all processes and files on the system.
Examples:
# Open files belonging to any process
lsof
# Open files used by the process ID 3
lsof -p 3
# Files used by networks processes
lsof -i
# Files used by network IPv4 processes
lsof -i 4
# Files used by network IPv6 processes
lsof -i 6
# List all open IPV4 network files in use by the process 1234
lsof -i 4 -a -p 1234
# Processes using files inside the indicated dir
lsof +D /lib
# Files uses by networks processes
lsof -i :80