The lsof tool on Linux allows you to monitor your system and detect possible problems more quickly. The program lists open files for this and can be optimized according to your objectives using filters and options.
What is Linux lsof?
On Linux, when you want control and analyze your system, the lsof command turns out to be a very easy tool to use. Developed and published in 1994 by Vic Abell, this open source program is part, by default, of many Linux distributions, such as Debian or Ubuntu. lsof stands for “List open files”. The program provides information relating to file types that are or have been opened at any given time by current processes.
Besides regular files, the tool can also process directories, sockets, drives or ports. The different processes and files are then clearly listed.
How does the lsof command work?
If the lsof command does not exist on your system, install it easily using this Linux command:
$ apt-get install lsofbash
You can now use the tool to obtain a overview of work processes on your computer. This feature relies on the fact that, under Unix systems, everything is normally visible as a file. The lsof command therefore allows you to check which processes have access to a given file.
What is the syntax of the lsof command?
Do you want to use lsof? Here is the basic syntax of the corresponding command:
$ lsof [Option] <Format>bash
You can certainly use lsof without any options or filters, but the subsequent display of results would still be extremely bulky and confusing. This approach is therefore not recommended.
What are the filters and options of Linux lsof?
The lsof command has many options for displaying results. Here are the main ones:
- -F : This option ensures that all results appear in a single column.
- -L : This option allows you to display the user ID instead of their name.
- -not : When you use this option, matching IP addresses are displayed instead of host names.
- -P : Service names are replaced by port numbers.
- -r [x] : this option ensures that the display of results is executed every x seconds.
- -t : With this option, only one list of PIDs (process identifiers) is displayed.
The lsof command also has many filtering options. Here are the main ones:
- -has : This is a logical AND operation instead of the OR operation which is usually used.
- -vs [Processus] : with this filter you learn which files are used by which processes.
- +D /folder/user : This filter provides information about a specific directory and its user.
- /dev/drive : This filter allows you to control a specific player.
- -i [TCP/UDP ou autre port ou adresse IP] : You receive information about which processes use which network services.
- +L1 : with this filter you receive information about already deleted files.
- +p PID : This filter provides you with information about which files are used by which PIDs.
- /path/file : with this option you receive information about a specific file.
- -u [Utilisateur] : you find out which user is using which files.
What is the Linux lsof command used for?
Finally, we will show you using a few examples how and for what purpose you can use the lsof command.
This example allows you to view all files that the administrator currently has open.
The lsof command is often used to control which programs block the mount command. It cannot be executed while the files are still open.
This command allows you to list all currently open ports.
