What it does
lsof lists open files for running processes.
On Unix, “everything is a file” — regular files, directories, pipes,
devices, and network sockets. lsof lets you see exactly
which process owns which file descriptor.
How it works (mechanical)
lsof inspects kernel and process state (commonly via /proc on Linux)
to enumerate file descriptors, then formats them into a searchable listing.
For network sockets, it decodes protocol/port/address metadata.
- Enumerates file descriptors per process
- Maps descriptors to paths, devices, pipes, and sockets
- Can filter by user, PID, file, mount, port, protocol
- Safe read-only introspection (unless paired with kill tools)
10 Practical Examples
# 1) Show open files for all processes (can be large) sudo lsof
# 2) Show open files for a specific PID sudo lsof -p 1234
# 3) Show which process is using a file sudo lsof /var/log/syslog
# 4) Show which processes have a directory open sudo lsof +D /mnt/data
# 5) Find what’s listening on a TCP port sudo lsof -iTCP:8080 -sTCP:LISTEN
# 6) Show all network connections for a process sudo lsof -p 1234 -i
# 7) Show all files opened by a user sudo lsof -u username
# 8) Show deleted-but-still-open files (disk space mysteries) sudo lsof | grep '(deleted)'
# 9) Identify processes preventing unmount sudo lsof +f -- /mnt/data
# 10) Quick “who’s using this port” one-liner sudo lsof -nP -iTCP:443 -sTCP:LISTEN
Notes & Gotchas
sudois often required for full visibility across users.+Dcan be expensive on large directory trees; use carefully.- Use
-nPto disable DNS and service-name lookups (faster). - Deleted-but-open files still consume disk until the process closes them.
- For purely socket-focused work,
sscan be faster.
Historical Context
lsof became a staple sysadmin tool because it exposes the “open file table”
— a direct window into process intent. On Linux, it’s especially valuable for diagnosing
port conflicts, stuck mounts, and disk space leaks from deleted files.
Modern Equivalent / Related Tools
- fuser — quick PID lookup for files/ports (and optional kill)
- ss — socket inspection and connection details
- ps — process inspection
- kill / pkill — terminate misbehaving processes
- systemctl — manage services cleanly