lsof command examples

lsof – list open files

Also, see fuser which serves the same purpose as lsof.

You may have faced problems while unmounting a filesystem or deleting a folder in Linux. You cannot perform folder (directory) delete/move operations while it is being used. You cannot unmount a filesystem while it is being used, whether it is NFS or a locally mounted filesystem.

Fortunately, you can identify the open file easily in Linux. “lsof” can help you to list open files. In the following example, I am trying to unmount a filesystem and it fails since it is being used. The “cwd” FD (file descriptor) indicates that the directory is the current working directory.

You may have entered into this directory in one of open the terminals. Navigate out of the directory if you can find terminal or kill the shell pid.

“lsof” can be used many other ways, it has endless options. Below are many examples that might help you.

To list all open files in Linux system, use:

#lsof

To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:

#lsof -i -U

To list all open IPv4 network files in use by the process whose PID is 1234, use:

#lsof -i 4 -a -p 1234

Presuming the UNIX dialect supports IPv6, to list only open IPv6 network files, use:

#lsof -i 6

To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu, use:

#lsof -i @wonderland.cc.purdue.edu:513-515

To list all files using any protocol on any port of electronproton.com  use:

#lsof -i @electronproton.com

To list all open files for login name “abe”, or user ID 1234, or process 456, or process 123, or process 789, use:

#lsof -p 456,123,789 -u 1234,abe

To list all open files on device /dev/hd4, use:

#lsof /dev/hd4

To find the process that has /u/abe/foo open, use:

#lsof /u/abe/foo

To send a SIGHUP to the processes that have /u/abe/bar open, use:

#kill -HUP `lsof -t /u/abe/bar`

To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

#lsof /dev/log

To find processes with open files on the NFS file system named /nfs/mount/point whose server is inaccessible, and presuming your mount table supplies the device number for /nfs/mount/point, use:

#lsof -b /nfs/mount/point

To do the preceding search with warning messages suppressed, use:

#lsof -bw /nfs/mount/point

To ignore the device cache file, use:

#lsof -Di

To obtain PID and command name field output for each process, file descriptor, file device number, and file inode number for each file of each process, use:

#lsof -FpcfDi

To list the files at descriptors 1 and 3 of every process running the lsof command for login ID “abe” every 10 seconds, use:

#lsof -c lsof -a -d 1 -d 3 -u abe -r10

To list the current working directory of processes running a command that is exactly four characters long and has an ‘o’ or ‘O’ in character three, use this regular expression form of the -c c option:

#lsof -c /^..o.$/i -a -d cwd

To find an IP version 4 socket file by its associated numeric dot-form address, use:

#lsof -i@128.210.15.17

To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by its associated numeric colon-form address, use:

#lsof -i@[0:1:2:3:4:5:6:7]

To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by an associated numeric colon-form address that has a run of zeroes in it – e.g., the loop-back address – use:

#lsof -i@[::1]

To obtain a repeat mode marker line that contains the current time, use:

#lsof -rm====%T====

To add spaces to the previous marker line, use:

#lsof -r "m==== %T ===="