lsof Command
Intermediate Performance & Debugging man(1)List open files and the processes that opened them
👁 12 views
📅 Updated: Mar 15, 2026
SYNTAX
lsof [OPTION]...
What Does lsof Do?
lsof (list open files) shows all files opened by processes. In Linux, everything is a file — network sockets, pipes, devices, and regular files — so lsof provides a comprehensive view of system activity.
lsof is essential for finding which process is using a port, which processes have a file open (preventing unmount), and diagnosing resource leaks. It is one of the most versatile troubleshooting tools.
lsof can filter by user, process, file, network port, and more. It shows the process name, PID, user, file descriptor, type, and file/socket details.
lsof is essential for finding which process is using a port, which processes have a file open (preventing unmount), and diagnosing resource leaks. It is one of the most versatile troubleshooting tools.
lsof can filter by user, process, file, network port, and more. It shows the process name, PID, user, file descriptor, type, and file/socket details.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -i | Show network connections | lsof -i |
| -i :PORT | Show processes using a port | lsof -i :80 |
| -p PID | Show files for specific process | lsof -p 1234 |
| -u USER | Show files for specific user | lsof -u www-data |
| +D DIR | Show files open in directory | lsof +D /var/log/ |
| -c NAME | Show files for command name | lsof -c nginx |
| -t | Show only PIDs (for scripting) | lsof -t -i :80 |
Practical Examples
#1 Find process using port
Shows which process is listening on port 80.
$ sudo lsof -i :80
Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1234 root 6u IPv4 12345 0t0 TCP *:http (LISTEN)
#2 All network connections
Shows all network connections without DNS resolution.
$ sudo lsof -i -P -n#3 Files open by process
Shows all files opened by the nginx process.
$ lsof -p $(pgrep nginx | head -1)#4 Who is using a file
Shows processes that have syslog open.
$ lsof /var/log/syslog#5 Files preventing unmount
Shows processes using files on a mounted filesystem.
$ lsof +D /mnt/usb/#6 Kill process on port
Kills whatever process is using port 8080.
$ kill $(lsof -t -i :8080)#7 Count open files by process
Counts open file descriptors for a user.
$ lsof -u www-data | wc -lTips & Best Practices
Find port owner: lsof -i :PORT is the fastest way to find what process is using a port. More detailed than ss or netstat.
-t for scripting: lsof -t returns only PIDs: kill $(lsof -t -i :8080) kills the process on port 8080.
Requires root for other users: Without root, lsof only shows your own processes. Use sudo for a complete picture.
Frequently Asked Questions
How do I find what is using a port?
sudo lsof -i :PORT shows the process name, PID, and user. Or sudo ss -tlnp | grep PORT.
How do I find why I cannot unmount?
lsof +D /mount/point shows all processes with open files on that filesystem. Kill them or cd out.
How do I count open files for a process?
lsof -p PID | wc -l. Or ls /proc/PID/fd | wc -l for a faster count.
Related Commands
More Performance & Debugging Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →