{"id":1512,"date":"2019-04-15T08:15:26","date_gmt":"2019-04-15T02:45:26","guid":{"rendered":"http:\/\/jaipurhosting.com\/blog\/?p=1512"},"modified":"2019-04-30T10:42:12","modified_gmt":"2019-04-30T05:12:12","slug":"10-lsof-command-examples-in-linux","status":"publish","type":"post","link":"https:\/\/www.jaipurhosting.com\/blog\/10-lsof-command-examples-in-linux\/","title":{"rendered":"10 lsof Command Examples in Linux"},"content":{"rendered":"\n
\n\n\n\n

Description<\/strong><\/p>\n\n\n\n

lsof<\/strong> meaning \u2018LiSt Open Files\u2019<\/strong> is used to find out which files are open by which process. <\/p>\n\n\n\n

As we all know Linux\/Unix<\/strong> considers everything as a files (pipes<\/strong>, sockets<\/strong>, directories<\/strong>, devices<\/strong> etc). <\/p>\n\n\n\n

One of the reason to use lsof<\/strong> command is when a disk cannot be unmounted as it says the files are being used. <\/p>\n\n\n\n

With the help of this command we can easily identify the files which are in use. <\/p>\n\n\n\n

1.List all Open Files with lsof Command<\/strong><\/h4>\n\n\n\n

In the below example, it will show long listing of open files some of them are extracted for better understanding which displays the columns like Command<\/strong>, PID<\/strong>, USER<\/strong>, FD<\/strong>, TYPE<\/strong> etc.<\/p>\n\n\n\n

# lsof\n\nCOMMAND    PID      USER   FD      TYPE     DEVICE  SIZE\/OFF       NODE NAME\ninit         1      root  cwd      DIR      253,0      4096          2 \/\ninit         1      root  rtd      DIR      253,0      4096          2 \/\ninit         1      root  txt      REG      253,0    145180     147164 \/sbin\/init\ninit         1      root  mem      REG      253,0   1889704     190149 \/lib\/libc-2.12.so\ninit         1      root   0u      CHR        1,3       0t0       3764 \/dev\/null\ninit         1      root   1u      CHR        1,3       0t0       3764 \/dev\/null\ninit         1      root   2u      CHR        1,3       0t0       3764 \/dev\/null\ninit         1      root   3r     FIFO        0,8       0t0       8449 pipe\ninit         1      root   4w     FIFO       0,8       0t0       8449 pipe\ninit         1      root   5r      DIR       0,10         0          1 inotify\ninit         1      root   6r      DIR       0,10         0          1 inotify\ninit         1      root   7u     unix 0xc1513880       0t0       8450 socket<\/code><\/pre>\n\n\n\n
Sections and it\u2019s values are self-explanatory. However, we\u2019ll review FD & TYPE<\/strong> columns more precisely.<\/p>\n\n\n\n
FD<\/strong> \u2013 stands for File descriptor and may seen some of the values as:<\/p>\n\n\n\n
  •  cwd<\/strong> current working directory <\/li>
  •  rtd<\/strong> root directory <\/li>
  •  txt<\/strong> program text (code and data) <\/li>
  •  mem<\/strong> memory-mapped file <\/li><\/ul>\n\n\n\n
    Also in FD<\/strong> column numbers like 1u<\/strong> is actual file descriptor and followed by u,r,w of it\u2019s mode as: <\/p>\n\n\n\n
    •  r<\/strong> for read access. <\/li>
    •  w<\/strong> for write access. <\/li>
    •  u<\/strong> for read and write access. <\/li><\/ul>\n\n\n\n
      TYPE<\/strong> \u2013 of files and it\u2019s identification. <\/p>\n\n\n\n
      •  DIR<\/strong> \u2013 Directory <\/li>
      •  REG<\/strong> \u2013 Regular file <\/li>
      •  CHR<\/strong> \u2013 Character special file. <\/li>
      •  FIFO<\/strong> \u2013 First In First Out <\/li><\/ul>\n\n\n\n
        <\/p>\n\n\n\n
        2. List User Specific Opened Files<\/strong><\/p>\n\n\n\n
        The below command will display the list of all opened files of user jaipur<\/strong>.
        <\/p>\n\n\n\n
        # lsof -u jaipur\n\nCOMMAND  PID    USER   FD   TYPE     DEVICE SIZE\/OFF   NODE NAME\nsshd    1838 jaipur  cwd    DIR      253,0     4096      2 \/\nsshd    1838 jaipur  rtd    DIR      253,0     4096      2 \/\nsshd    1838 jaipur  txt    REG      253,0   532336 188129 \/usr\/sbin\/sshd\nsshd    1838 jaipur  mem    REG      253,0    19784 190237 \/lib\/libdl-2.12.so\nsshd    1838 jaipur  mem    REG      253,0   122436 190247 \/lib\/libselinux.so.1\nsshd    1838 jaipur  mem    REG      253,0   255968 190256 \/lib\/libgssapi_krb5.so.2.2\nsshd    1838 jaipur  mem    REG      253,0   874580 190255 \/lib\/libkrb5.so.3.3<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        3. Find Processes running on Specific Port<\/strong><\/p>\n\n\n\n
        To find out all the running process of specific port, just use the following command with option -i<\/strong>. <\/p>\n\n\n\n
        The below example will list all running process of port 22<\/strong>.<\/p>\n\n\n\n
        # lsof -i TCP:22\n\nCOMMAND  PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nsshd    1471    root    3u  IPv4  12683      0t0  TCP *:ssh (LISTEN)\nsshd    1471    root    4u  IPv6  12685      0t0  TCP *:ssh (LISTEN)<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        4. List Only IPv4 & IPv6 Open Files<\/strong><\/p>\n\n\n\n
        In below example shows only IPv4<\/strong> and IPv6<\/strong> network files open with separate commands.<\/p>\n\n\n\n
        # lsof -i 4\n\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nrpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc\nrpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954\nrpcbind   1203     rpc    8u  IPv4  11331      0t0  TCP *:sunrpc (LISTEN)\navahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns\navahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600\n\n# lsof -i 6\n\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nrpcbind   1203     rpc    9u  IPv6  11333      0t0  UDP *:sunrpc\nrpcbind   1203     rpc   10u  IPv6  11335      0t0  UDP *:954\nrpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\nrpc.statd 1277 rpcuser   10u  IPv6  11858      0t0  UDP *:55800\nrpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)\ncupsd     1346    root    6u  IPv6  12112      0t0  TCP localhost:ipp (LISTEN)<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        5. List Open Files of TCP Port ranges 1-1024<\/strong><\/p>\n\n\n\n
        To list all the running process of open files of TCP<\/strong> Port ranges from 1-1024<\/strong>.<\/p>\n\n\n\n
        # lsof -i TCP:1-1024\n\nCOMMAND  PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nrpcbind 1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\ncupsd   1346    root    7u  IPv4  12113      0t0  TCP localhost:ipp (LISTEN)\nsshd    1471    root    4u  IPv6  12685      0t0  TCP *:ssh (LISTEN)\nmaster  1551    root   13u  IPv6  12898      0t0  TCP localhost:smtp (LISTEN)\nsshd    1834    root    3r  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)\nsshd    1838 tecmint    3u  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)\nsshd    1871    root    3r  IPv4  15842      0t0  TCP 192.168.0.2:ssh->192.168.0.1:groove (ESTABLISHED)\nhttpd   1918    root    5u  IPv6  15991      0t0  TCP *:http (LISTEN)\nhttpd   1918    root    7u  IPv6  15995      0t0  TCP *:https (LISTEN)<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        6. Exclude User with \u2018^\u2019 Character<\/strong><\/p>\n\n\n\n
        Here, we have excluded root<\/strong> user. <\/p>\n\n\n\n
        You can exclude a particular user using \u2018^\u2019<\/strong> with command as shown above.<\/p>\n\n\n\n
        # lsof -i -u^root\n\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nrpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc\nrpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954\nrpcbind   1203     rpc    8u  IPv4  11331      0t0  TCP *:sunrpc (LISTEN)\nrpcbind   1203     rpc    9u  IPv6  11333      0t0  UDP *:sunrpc\nrpcbind   1203     rpc   10u  IPv6  11335      0t0  UDP *:954\nrpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\navahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns\navahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600\nrpc.statd 1277 rpcuser    5r  IPv4  11836      0t0  UDP *:soap-beep\nrpc.statd 1277 rpcuser    8u  IPv4  11850      0t0  UDP *:55146\nrpc.statd 1277 rpcuser    9u  IPv4  11854      0t0  TCP *:32981 (LISTEN)\nrpc.statd 1277 rpcuser   10u  IPv6  11858      0t0  UDP *:55800\nrpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        7. Find Out who\u2019s Looking What Files and Commands?<\/strong><\/p>\n\n\n\n
        Below example shows user jaipur <\/b><\/span>is using command like ping<\/strong> and \/etc<\/strong> directory .<\/p>\n\n\n\n
        # lsof -i -u jaipur\n\nCOMMAND  PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nbash    1839 jaipur  cwd    DIR  253,0    12288   15 \/etc\nping    2525 jaipur  cwd    DIR  253,0    12288   15 \/etc<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        8. List all Network Connections<\/strong><\/p>\n\n\n\n
        The following command with option \u2018-i\u2019<\/strong> shows the list of all network connections \u2018LISTENING & ESTABLISHED\u2019<\/strong>.<\/p>\n\n\n\n
        # lsof -i\n\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE\/OFF NODE NAME\nrpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc\nrpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954\nrpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)\navahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns\navahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600\nrpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)\ncupsd     1346    root    6u  IPv6  12112      0t0  TCP localhost:ipp (LISTEN)\ncupsd     1346    root    7u  IPv4  12113      0t0  TCP localhost:ipp (LISTEN)\nsshd      1471    root    3u  IPv4  12683      0t0  TCP *:ssh (LISTEN)\nmaster    1551    root   12u  IPv4  12896      0t0  TCP localhost:smtp (LISTEN)\nmaster    1551    root   13u  IPv6  12898      0t0  TCP localhost:smtp (LISTEN)\nsshd      1834    root    3r  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)\nhttpd     1918    root    5u  IPv6  15991      0t0  TCP *:http (LISTEN)\nhttpd     1918    root    7u  IPv6  15995      0t0  TCP *:https (LISTEN)\nclock-app 2362   narad   21u  IPv4  22591      0t0  TCP 192.168.0.2:45284->www.gov.com:http (CLOSE_WAIT)\nchrome    2377   narad   61u  IPv4  25862      0t0  TCP 192.168.0.2:33358->maa03s04-in-f3.1e100.net:http (ESTABLISHED)\nchrome    2377   narad   80u  IPv4  25866      0t0  TCP 192.168.0.2:36405->bom03s01-in-f15.1e100.net:http (ESTABLISHED)<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        9. Search by PID<\/strong><\/p>\n\n\n\n
        The below example only shows whose PID<\/strong> is 1<\/strong> [One<\/strong>].<\/p>\n\n\n\n
        # lsof -p 1\n\nCOMMAND PID USER   FD   TYPE     DEVICE SIZE\/OFF   NODE NAME\ninit      1 root  cwd    DIR      253,0     4096      2 \/\ninit      1 root  rtd    DIR      253,0     4096      2 \/\ninit      1 root  txt    REG      253,0   145180 147164 \/sbin\/init\ninit      1 root  mem    REG      253,0  1889704 190149 \/lib\/libc-2.12.so\ninit      1 root  mem    REG      253,0   142472 189970 \/lib\/ld-2.12.so<\/code><\/pre>\n\n\n\n
        <\/h4>\n\n\n\n
        10. Kill all Activity of Particular User<\/strong><\/p>\n\n\n\n
        Sometimes you may have to kill all the processes for a specific user. <\/p>\n\n\n\n
        Below command will kills all the processes of jaipur <\/b><\/span>user.
        <\/p>\n\n\n\n
        # kill -9 `lsof -t -u jaipur`<\/code><\/pre>\n\n\n\n
        Note:<\/strong> Here, it\u2019s not possible to give example of all available options, this guide is only to show how lsof<\/strong>command can be use. <\/p>\n\n\n\n
        You may refer man page of lsof<\/strong> command to know more about it. <\/p>\n\n\n\n
         
        We hope you\u2019ve found this useful! <\/p>\n\n\n\n
        <\/p>\n","protected":false},"excerpt":{"rendered":"
        Description lsof meaning \u2018LiSt Open Files\u2019 is used to find out which files are open by which process. As we all know Linux\/Unix considers everything as a files (pipes, sockets, directories, devices etc). One of the reason to use lsof command is when a disk cannot be unmounted as it says the files are being used. With the help of this command we can easily identify […]<\/p>\n","protected":false},"author":1,"featured_media":1513,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1512","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/posts\/1512","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/comments?post=1512"}],"version-history":[{"count":10,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/posts\/1512\/revisions"}],"predecessor-version":[{"id":1532,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/posts\/1512\/revisions\/1532"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/media\/1513"}],"wp:attachment":[{"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/media?parent=1512"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/categories?post=1512"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jaipurhosting.com\/blog\/wp-json\/wp\/v2\/tags?post=1512"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}