lsof - Unix, Linux Command

lsof: list open files.
lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g[s] ] [ -i [i] ] 
[ -k k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ][ -o [o] ] [ -p s ] [ +|-r [t[m]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] 
[ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]

lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g[s] ] [ -i [i] ] 
[ -k k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ][ -o [o] ] [ -p s ] [ +|-r [t[m]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] 
[ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]
An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.) A specific file or all the files in a file system may be selected by path.
Instead of a formatted display, lsof will produce output that can be parsed by other programs. In addition to producing a single output list, lsof will run in repeat mode. In repeat mode it will produce output, delay, then repeat the output operation until stopped with an interrupt or quit signal.
Example-1:
To list all Open Files:
# lsof
output:
# lsof COMMAND    PID  TID            USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAMEinit         1                 root  cwd       DIR              252,0     4096          2 /init         1                 root  rtd       DIR              252,0     4096          2 /init         1                 root  txt       REG              252,0   265848         54 /sbin/initinit         1                 root  mem       REG              252,0    47712     393444 /lib/x86_64-linux-gnu/libnss_files-2.19.soinit         1                 root  mem       REG              252,0    47760     393448 /lib/x86_64-linux-gnu/libnss_nis-2.19.soinit         1                 root  mem       REG              252,0    97296     393438 /lib/x86_64-linux-gnu/libnsl-2.19.soinit         1                 root  mem       REG              252,0    39824     393440 /lib/x86_64-linux-gnu/libnss_compat-2.19.soinit         1                 root  mem       REG              252,0    14664     393401 /lib/x86_64-linux-gnu/libdl-2.19.soinit         1                 root  mem       REG              252,0   252032     393460 /lib/x86_64-linux-gnu/libpcre.so.3.13.1init         1                 root  mem       REG              252,0   141574     393475 /lib/x86_64-linux-gnu/libpthread-2.19.soinit         1                 root  mem       REG              252,0  1840928     393385 /lib/x86_64-linux-gnu/libc-2.19.soinit         1                 root  mem       REG              252,0    31792     393481 /lib/x86_64-linux-gnu/librt-2.19.soinit         1                 root  mem       REG              252,0    43464     393417 /lib/x86_64-linux-gnu/libjson-c.so.2.0.0init         1                 root  mem       REG              252,0   134296     393483 /lib/x86_64-linux-gnu/libselinux.so.1...
kworker/0    5                 root  cwd       DIR              252,0     4096          2 /kworker/0    5                 root  rtd       DIR              252,0     4096          2 /kworker/0    5                 root  txt   unknown                                        /proc/5/exe
more...
Example-2:
To list User Specific Opened Files:
# lsof -u ubuntu
output:
COMMAND  PID   USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAMEsshd    1427 ubuntu  cwd    DIR              252,0     4096      2 /sshd    1427 ubuntu  rtd    DIR              252,0     4096      2 /sshd    1427 ubuntu  txt    REG              252,0   766784 800542 /usr/sbin/sshdsshd    1427 ubuntu  mem    REG              252,0    14464 393517 /lib/x86_64-linux-gnu/security/pam_env.sosshd    1427 ubuntu  mem    REG              252,0    22896 393526 /lib/x86_64-linux-gnu/security/pam_limits.sosshd    1427 ubuntu  mem    REG              252,0    10320 393530 /lib/x86_64-linux-gnu/security/pam_mail.sosshd    1427 ubuntu  mem    REG              252,0    10344 393532 /lib/x86_64-linux-gnu/security/pam_motd.sosshd    1427 ubuntu  mem    REG              252,0    14592 393455 /lib/x86_64-linux-gnu/libpam_misc.so.0.82.0sshd    1427 ubuntu  mem    REG              252,0    38920 393435 /lib/x86_64-linux-gnu/libnih-dbus.so.1.0.0sshd    1427 ubuntu  mem    REG              252,0    96280 393437 /lib/x86_64-linux-gnu/libnih.so.1.0.0sshd    1427 ubuntu  mem    REG              252,0   108480 393390 /lib/x86_64-linux-gnu/libcgmanager.so.0.0.0sshd    1427 ubuntu  mem    REG              252,0    42864 398327 /lib/x86_64-linux-gnu/security/pam_systemd.sosshd    1427 ubuntu  mem    REG              252,0    10376 393550 /lib/x86_64-linux-gnu/security/pam_umask.sosshd    1427 ubuntu  mem    REG              252,0    10288 393524 /lib/x86_64-linux-gnu/security/pam_keyinit.sosshd    1427 ubuntu  mem    REG              252,0    10344 393529 /lib/x86_64-linux-gnu/security/pam_loginuid.sosshd    1427 ubuntu  mem    REG              252,0    18752 393540 /lib/x86_64-linux-gnu/security/pam_selinux.sosshd    1427 ubuntu  mem    REG              252,0    10272 393534 /lib/x86_64-linux-gnu/security/pam_nologin.sosshd    1427 ubuntu  mem    REG              252,0    18952 393388 /lib/x86_64-linux-gnu/libcap.so.2.24sshd    1427 ubuntu  mem    REG              252,0    10376 393513 /lib/x86_64-linux-gnu/security/pam_cap.sosshd    1427 ubuntu  mem    REG              252,0     6112 393535 /lib/x86_64-linux-gnu/security/pam_permit.sosshd    1427 ubuntu  mem    REG              252,0     6024 393515 /lib/x86_64-linux-gnu/security/pam_deny.sosshd    1427 ubuntu  mem    REG              252,0    60288 393551 /lib/x86_64-linux-gnu/security/pam_unix.sosshd    1427 ubuntu  mem    REG              252,0    22952 393442 /lib/x86_64-linux-gnu/libnss_dns-2.19.so
Example-3:
To find Processes running on Specific Port:
# lsof -i TCP:22
output:
# lsof -i TCP:22COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEsshd    1053   root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)sshd    1053   root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)sshd    1377   root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd    1427 ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd    1840   root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)sshd    1930 ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
Example-4:
To list Only IPv4 & IPv6 Open Files:
# lsof -i 4
# lsof -i 6
output:
# lsof -i 4COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEdhclient  869            root    6u  IPv4  11754      0t0  UDP *:bootpcdhclient  869            root   20u  IPv4  11700      0t0  UDP *:26374sshd     1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)dnsmasq  1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootpsdnsmasq  1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domaindnsmasq  1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)sshd     1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd     1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd     1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)sshd     1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
# lsof -i 6COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEdhclient  869 root   21u  IPv6  11701      0t0  UDP *:22830sshd     1053 root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)
Example-5:
To list Open Files of TCP Port ranges 1-1024:
# lsof -i TCP:1-1024
output:
#  lsof -i TCP:1-1024COMMAND  PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEsshd    1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)sshd    1053            root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)dnsmasq 1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)sshd    1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd    1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd    1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)sshd    1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
Example-6:
To Exclude User with ‘^’ Characte
# lsof -i -u^root
output:
#  lsof -i -u^rootCOMMAND  PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEdnsmasq 1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootpsdnsmasq 1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domaindnsmasq 1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)sshd    1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd    1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
Example-7:
To find Out who’s Looking What Files and Commands:
# lsof -i -u user1
output:
#  lsof -i -u user1COMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEdhclient  869            root    6u  IPv4  11754      0t0  UDP *:bootpcdhclient  869            root   20u  IPv4  11700      0t0  UDP *:26374dhclient  869            root   21u  IPv6  11701      0t0  UDP *:22830sshd     1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)sshd     1053            root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)dnsmasq  1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootpsdnsmasq  1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domaindnsmasq  1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)sshd     1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd     1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd     1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)sshd     1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
Example-8:
To list all Network Connections:
# lsof -i
output:
# lsof -iCOMMAND   PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAMEdhclient  869            root    6u  IPv4  11754      0t0  UDP *:bootpcdhclient  869            root   20u  IPv4  11700      0t0  UDP *:26374dhclient  869            root   21u  IPv6  11701      0t0  UDP *:22830sshd     1053            root    3u  IPv4  13211      0t0  TCP *:ssh (LISTEN)sshd     1053            root    4u  IPv6  13213      0t0  TCP *:ssh (LISTEN)dnsmasq  1372 libvirt-dnsmasq    4u  IPv4  13970      0t0  UDP *:bootpsdnsmasq  1372 libvirt-dnsmasq    6u  IPv4  13973      0t0  UDP 192.168.122.1:domaindnsmasq  1372 libvirt-dnsmasq    7u  IPv4  13974      0t0  TCP 192.168.122.1:domain (LISTEN)sshd     1377            root    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd     1427          ubuntu    3u  IPv4  13987      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:63725 (ESTABLISHED)sshd     1840            root    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)sshd     1930          ubuntu    3u  IPv4  14871      0t0  TCP testserver.tutorailspoint.com:ssh->192.168.134.1:53307 (ESTABLISHED)
Example-9:
To list processes which opened a specific file:
# lsof /var/log/syslog
output:
#  lsof /var/log/syslogCOMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF  NODE NAMErsyslogd 687 syslog    1w   REG  252,0  1812935 11325 /var/log/syslog
Example-10:
To list opened files under a directory:
# lsof +D /var/log/
output:
# lsof +D /var/log/COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAMEinit        1   root   14w   REG  252,0      733  11346 /var/log/upstart/systemd-logind.logrsyslogd  687 syslog    1w   REG  252,0  1813034  11325 /var/log/syslogrsyslogd  687 syslog    2w   REG  252,0  1694014  11335 /var/log/kern.logrsyslogd  687 syslog    4w   REG  252,0    39603  11870 /var/log/auth.loglibvirtd 1171   root    4w   REG  252,0        0 135812 /var/log/libvirt/libvirtd.log
Example-11:
To list opened files based on process names:
# lsof -c ssh -c init
output:
COMMAND  PID   USER   FD   TYPE             DEVICE SIZE/OFF   NODE NAMEinit       1   root  cwd    DIR              252,0     4096      2 /init       1   root  rtd    DIR              252,0     4096      2 /init       1   root  txt    REG              252,0   265848     54 /sbin/initinit       1   root  mem    REG              252,0    47712 393444 /lib/x86_64-linux-gnu/libnss_files-2.19.soinit       1   root  mem    REG              252,0    47760 393448 /lib/x86_64-linux-gnu/libnss_nis-2.19.soinit       1   root  mem    REG              252,0    97296 393438 /lib/x86_64-linux-gnu/libnsl-2.19.soinit       1   root  mem    REG              252,0    39824 393440 /lib/x86_64-linux-gnu/libnss_compat-2.19.soinit       1   root  mem    REG              252,0    14664 393401 /lib/x86_64-linux-gnu/libdl-2.19.soinit       1   root  mem    REG              252,0   252032 393460 /lib/x86_64-linux-gnu/libpcre.so.3.13.1init       1   root  mem    REG              252,0   141574 393475 /lib/x86_64-linux-gnu/libpthread-2.19.soinit       1   root  mem    REG              252,0  1840928 393385 /lib/x86_64-linux-gnu/libc-2.19.soinit       1   root  mem    REG              252,0    31792 393481 /lib/x86_64-linux-gnu/librt-2.19.soinit       1   root  mem    REG              252,0    43464 393417 /lib/x86_64-linux-gnu/libjson-c.so.2.0.0