lsof Command Cheatsheet

Browse / lsof Command Cheatsheet

April 26, 2025 19:59

linux

lsof

networking

sysadmin

troubleshooting

Download PDF

Missing something?

Basic Usage & Filters

Basic Listing

`lsof`	List all open files for all active processes. This can produce a very large output.
`lsof \| less`	Pipe the output to `less` for easier viewing and searching.
`lsof -u <user>`	List files opened by a specific user. Example: `lsof -u root`
`lsof -i`	List all network connections (sockets). Includes TCP, UDP, and raw sockets.
`lsof -c <command>`	List files opened by processes running a specific command. Example: `lsof -c nginx`
`lsof -p <pid>`	List files opened by a specific process ID. Example: `lsof -p 1234`
`lsof -d <fd>`	List files opened with a specific file descriptor. Example: `lsof -d 1` (File descriptor 1 usually refers to standard output)
`lsof -d ^<fd>`	List files EXCEPT those with a specific file descriptor. Example: `lsof -d ^1` (Exclude standard output)

Network Filters

`lsof -i TCP`	List all open TCP network connections.
`lsof -i UDP`	List all open UDP network connections.
`lsof -i :<port>`	List processes listening on or connected to a specific port. Example: `lsof -i :80` (List processes using port 80)
`lsof -i TCP:<port>`	List TCP connections on a specific port. Example: `lsof -i TCP:443`
`lsof -i @<address>`	List network activity related to a specific host address. Example: `lsof -i @localhost`
`lsof -i @<address>:<port>`	List network activity related to a specific host and port. Example: `lsof -i @192.168.1.100:22`
`lsof -i :<start>-<end>`	List network activity within a port range. Example: `lsof -i :1024-2000`
`lsof -i -P`	Disable port number to name mapping (shows numeric ports).

Process & File System Filters

`lsof -a -u <user> -c <cmd>`	Combine options with `-a` (AND logic). List files opened by `<user>` running `<cmd>`. Example: `lsof -a -u www-data -c apache2`
`lsof -u ^<user>`	List files opened by everyone EXCEPT a specific user. Example: `lsof -u ^root`
`lsof -p ^<pid>`	List files opened by all processes EXCEPT a specific PID. Example: `lsof -p ^1` (Exclude `init` process)
`lsof <file>`	List processes that have a specific file open. Example: `lsof /var/log/syslog`
`lsof +D <directory>`	List all open files within a directory (and its subdirectories). Example: `lsof +D /tmp`
`lsof +d <directory>`	List only files opened directly in the specified directory (no recursion). Example: `lsof +d /etc`
`lsof -F n`	Output filenames only. Useful for scripting. Example: `lsof -F n /var/log`
`lsof -v`	Display `lsof` version information.
`lsof -l`	Include user ID numbers in the output.

Advanced Usage & Output

Output Fields Explained

`COMMAND`	The command name (often truncated).
`PID`	Process ID.
`TID`	Task ID (Thread ID) if the `-K` option is used.
`USER`	User ID or name of the process owner.
`FD`	File Descriptor number and type. Examples: `cwd`: current working directory `rtd`: root directory `txt`: program text (code and data) `mem`: memory-mapped file `mmap`: memory-mapped device file `<n>u`: file descriptor `<n>` opened for read/write (`u` for unknown) `<n>r`: read only `<n>w`: write only `<n>R`: raw socket `<n>t`: terminal device
`TYPE`	Type of node associated with the file. Examples: `REG`: regular file `DIR`: directory `CHR`: character special file `BLK`: block special file `FIFO`: FIFO special file (named pipe) `SOCK`: socket file `UNIX`: UNIX domain socket `IPv4`: IPv4 socket `IPv6`: IPv6 socket
`DEVICE`	Device numbers for the file.
`SIZE/OFF`	Size of the file or the file offset.
`NODE`	Node number of the local file system file or the inode number.
`NAME`	Name of the file, network address, etc.

Common Use Cases & Tips

`lsof /dev/sda1`	Find processes accessing a specific device.
`lsof +L`	List files that are currently linked to but have been deleted (shows `(deleted)` in output). Useful for finding processes holding onto disk space.
`lsof -i :<port> -s TCP:LISTEN`	Find processes listening on a specific TCP port. Example: `lsof -i :8080 -s TCP:LISTEN`
`lsof -i -T TCP`	Show TCP options. Use `-T` followed by specific options (e.g., `W` for window sizes). Example: `lsof -i -T W` (Show TCP window sizes)
`lsof -t -i :<port>`	Output only PIDs using a specific port. Useful for scripting (e.g., killing processes). Example: `kill $(lsof -t -i :3000)`
`lsof -r <seconds>`	Repeat `lsof` output every `<seconds>`. Useful for monitoring dynamic changes. Example: `lsof -r 5 -i :80` (Monitor port 80 every 5 seconds)
`lsof -b`	Avoid kernel blocking. `lsof` may block if the kernel file structure table is being accessed. Use this to prevent blocking, but the output might be incomplete.
`lsof -n -P`	Disable host name resolution (`-n`) and port name resolution (`-P`). Speeds up execution, especially on large systems or slow DNS. Good practice for general use unless names are required.

Troubleshooting Examples

Find which process is using a port:

lsof -i :8080

Find the COMMAND, PID, and USER in the output.

Find why a disk is full (deleted files):

lsof +L1

Look for large files marked (deleted). Identify the PID and restart/kill the process holding the file handle.

Identify network connections for a specific process:

lsof -p <pid> -i

Replace <pid> with the actual process ID.

See all files opened by user ‘daemon’:

lsof -u daemon

Check if a specific file is open and by whom:

lsof /path/to/your/file

Determine which process has a lock on a file:
lsof can sometimes show file locks (depending on the system and lock type), often indicated by the lck FD type or flags in the output. While not foolproof for all lock types, it’s a good starting point.

Look for output lines related to the file and check the FD column for lock indicators.