lsof command usages with example
lsof command usages is a mandatory thing that every sys admin must know. lsof command lists open files. It’s the short form of “LiSt Open Files.” This command has a vital role in server Administration.
This command reveals the files which are opened by a process. In Linux/Unix, everything is considered as a file such as pipes, sockets, devices etc are treated as files. Thus, by using ‘lsof‘ command we will get the information of any opened files.
lsof commands in linux
1, List all open files using lsof command
# lsof
This command long lists all the open files belonging to all active processes currently running on the server/system. The image added below will give you a close view on it.
In the above screenshot, you can see some columns such as command, PID, user, FD, TYPE etc
FD - File descriptor
Some of the values in FD are
cwd - Current working directory
txt - Text file
mem - Memory Mapped file
mmap - Memory Mapped device
Number - It represent the actual file descriptor. For example, 0u, 1w and 3r
r represents read, w represents write and u represents both read and write.
Type represents type of the file. Some of the values of TYPE are
>REG - Regular file
>DIR - Directory
>CHR - Character special file
>FIFO - First in first out
lsof commands switches
2, To list user specific opened files
# lsof -u user_name
Yeah, the ablove command will lists all opened files by processes for a specific user on your server.
Example:
# lsof -u crybit
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 29609 crybit cwd DIR 144,233 4096 117711421 /
sshd 29609 crybit rtd DIR 144,233 4096 117711421 /
sshd 29609 crybit txt REG 144,233 409488 119020186 /usr/sbin/sshd
sshd 29609 crybit mem REG 144,241 2443001619 (deleted)/dev/zero (stat: No such file or directory)
sshd 29609 crybit mem REG 8,37 119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021984 /lib64/security/pam_succeed_if.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119022000 /lib64/security/pam_limits.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021960 /lib64/security/pam_keyinit.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021972 /lib64/security/pam_cracklib.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021987 /lib64/security/pam_nologin.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021988 /lib64/security/pam_deny.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119019223 /usr/lib64/libcrack.so.2.8.0 (path dev=144,233)
.....
.....
3, Process running on a port
# lsof -i :port_number
This lists all opened files for processes running on a specific port.
Example:
# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
# lsof -i :3306
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 11106 mysql 10u IPv4 2340975114 0t0 TCP *:mysql (LISTEN)
4, Lists only IPv4 and IPv6 open files
# lsof -i 4 - For IPv4
Example:
# lsof -i 4
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
named 8362 named 20u IPv4 2334751017 0t0 TCP localhost.localdomain:domain (LISTEN)
named 8362 named 21u IPv4 2334751019 0t0 TCP crybit.com:domain (LISTEN)
named 8362 named 22u IPv4 2334751021 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 512u IPv4 2334751016 0t0 UDP localhost.localdomain:domain
named 8362 named 513u IPv4 2334751018 0t0 UDP crybit.com:domain
tcpserver 9975 root 3u IPv4 2335487959 0t0 TCP *:pop3 (LISTEN)
tcpserver 9978 root 3u IPv4 2335487967 0t0 TCP *:pop3s (LISTEN)
tcpserver 9983 root 3u IPv4 2335487997 0t0 TCP *:imap (LISTEN)
tcpserver 9987 root 3u IPv4 2335488014 0t0 TCP *:imaps (LISTEN)
xinetd 10413 root 5u IPv4 2336070983 0t0 TCP *:ftp (LISTEN)
xinetd 10413 root 6u IPv4 2336070984 0t0 TCP *:smtp (LISTEN)
mysqld 11106 mysql 10u IPv4 2340975114 0t0 TCP *:mysql (LISTEN)
# lsof -i 6
Example:
# lsof -i 6
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
named 8362 named 23u IPv6 2334751024 0t0 TCP localhost.localdomain:rndc (LISTEN)
httpd 29241 root 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29241 root 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29243 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29243 apache 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29244 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29244 apache 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29245 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29245 apache 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29246 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
5, Lists open files for TCP port ranges 1-1024
# lsof -i :1-1024
This is very helpful to know the open files for processes running under a specific port range.
Example:
# lsof -i :1-1024
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
named 8362 named 20u IPv4 2334751017 0t0 TCP localhost.localdomain:domain (LISTEN)
named 8362 named 21u IPv4 2334751019 0t0 TCP crybit.com:domain (LISTEN)
named 8362 named 22u IPv4 2334751021 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 23u IPv6 2334751024 0t0 TCP localhost.localdomain:rndc (LISTEN)
tcpserver 9975 root 3u IPv4 2335487959 0t0 TCP *:pop3 (LISTEN)
tcpserver 9978 root 3u IPv4 2335487967 0t0 TCP *:pop3s (LISTEN)
tcpserver 9983 root 3u IPv4 2335487997 0t0 TCP *:imap (LISTEN)
tcpserver 9987 root 3u IPv4 2335488014 0t0 TCP *:imaps (LISTEN)
xinetd 10413 root 5u IPv4 2336070983 0t0 TCP *:ftp (LISTEN)
xinetd 10413 root 6u IPv4 2336070984 0t0 TCP *:smtp (LISTEN)
httpd 29241 root 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29241 root 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29243 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
....
....
6, Lists by pid
# lsof -p PID
This is the most commonly using command as in most case we need to list open files for a specific PID.
Example:
# lsof -p 11106
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 11106 mysql cwd DIR 144,233 4096 119025114 /var/lib/mysql
mysqld 11106 mysql rtd DIR 144,233 4096 117711421 /
mysqld 11106 mysql txt REG 144,233 9484782 119025094 /usr/libexec/mysqld
mysqld 11106 mysql mem REG 8,37 119025094 /usr/libexec/mysqld (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021830 /lib64/libnss_files-2.5.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021841 /lib64/libsepol.so.1 (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021801 /lib64/libselinux.so.1 (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021785 /lib64/libresolv-2.5.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021920 /lib64/libkeyutils-1.2.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119017006 /usr/lib64/libkrb5support.so.0.1 (path dev=144,233)
....
....
How to update a Docker image with new changes?
We can build many containers from a single image. An image is a combination of a file system and parameters.
Once the container is launched using an image, you can make changes on that container. Like, you can create new files, you can install new modules, packages etc.. These changes will persist on the container as long as it exists. Read more…
7, Kill all activity for a particular user
# killall -9 `lsof -t -u username`
8, Opened files in a directory
# lsof +D path_of_the_directory
Example:
# lsof +D /var/log/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslogd 9729 root 1w REG 144,233 0 119019158 /var/log/kernel
syslogd 9729 root 2w REG 144,233 350722 119021699 /var/log/messages
syslogd 9729 root 3w REG 144,233 591577 119019159 /var/log/secure
syslogd 9729 root 4w REG 144,233 591577 119019159 /var/log/secure
9, Opened files based on process names
# lsof -c process_name
Example:
# lsof -c ssh
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 483 root cwd DIR 8,9 4096 2 /
sshd 483 root rtd DIR 8,9 4096 2 /
sshd 483 root txt REG 8,9 523488 1193409 /usr/sbin/sshd
10, List all network connections.
# lsof -i
This command lists all network connections “Listening and Established.”
Example:
# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
named 8362 named 20u IPv4 2334751017 0t0 TCP localhost.localdomain:domain (LISTEN)
named 8362 named 21u IPv4 2334751019 0t0 TCP crybit.com:domain (LISTEN)
named 8362 named 22u IPv4 2334751021 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 23u IPv6 2334751024 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 512u IPv4 2334751016 0t0 UDP localhost.localdomain:domain
That’s it!! 🙂
Other commands:
groupdel, groupmems, groupmod, useradd , usermod , chgrp, chown, ls, head, tail, top, ps, find, crontab, ftp commands, tar, rpm, rkhunter, Rsync, grep, netstat command’s practical usages, OpenVZ commands
One thought on “lsof command usages with example – Unix/Linux”