Linux lsof Command: Find Open Files

The lsof command, short for "List Open Files," is a powerful diagnostic utility in the Linux operating system used to identify which files are opened by which processes. Because Unix-like systems adhere to the philosophy that "everything is a file"—including regular files, directories, network sockets, block devices, and named pipes—lsof provides crucial visibility into active system operations. This guide covers what lsof does, why it is essential for system administration, and how to use it to identify file-locking processes, troubleshoot unmount errors, and inspect network connections.

Why Use lsof?

When a Linux system indicates that a file is in use, or prevents a device from unmounting with a "device is busy" error, lsof determines the exact process responsible. It reads kernel memory to retrieve information about file descriptors currently assigned to running programs.

Common administrative tasks for lsof include:

• Troubleshooting Unmount Failures: Identifying applications or processes actively reading from or writing to a mounted drive or partition.
• Reclaiming Disk Space: Finding unlinked (deleted) files that continue to consume disk space because an active process still holds an open file handle.
• Security and Auditing: Determining which users are accessing sensitive files or directories.
• Network Diagnostics: Mapping open network ports and active network connections back to the specific processes running them.

Understanding the Output

Running lsof without arguments lists all files opened by every active process on the system. The output provides several key columns:

• COMMAND: The name of the process or executable.
• PID: The unique Process ID running the file.
• USER: The user account that owns the process.
• FD (File Descriptor): The status of the file descriptor (e.g., cwd for current working directory, txt for program code, or numbers indicating read/write mode).
• TYPE: The type of node associated with the file (e.g., REG for regular file, DIR for directory, IPv4/IPv6 for network connections).
• DEVICE: The device numbers (major and minor) containing the file.
• SIZE/OFF: The size of the file or the current file offset.
• NODE: The inode number of the file on the filesystem.
• NAME: The absolute path to the file, mount point, or network address.

Common lsof Usage Examples

1. Identify Which Process Is Using a Specific File or Directory

To see what process has opened a particular file or is operating inside a specific directory:

lsof /var/log/syslog
lsof /mnt/storage

2. Resolve "Device Is Busy" Errors

When attempting to unmount a filesystem (e.g., umount /mnt/backup) and the system reports the target is busy, list all open files under that mount point:

lsof +D /mnt/backup

The +D flag recursively searches the directory for open file descriptors. Once identified, you can safely close the process or terminate it using its PID.

3. Find Open Files by Process ID (PID)

To see every resource currently held open by a specific running process:

lsof -p 1234

4. Find Files Opened by a Specific User

To audit activity for a particular user account:

lsof -u username

To exclude a specific user from the results, prepend their username with a caret (^):

lsof -u ^username

5. Track Network Sockets and Ports

Because network connections are handled as files, lsof can inspect active networking:

• List all network connections:

  lsof -i

• Find which process is listening on a specific port (e.g., port 80 or 443):

  lsof -i :80
  lsof -i :443

• Filter by protocol (TCP or UDP):

  lsof -i TCP:22

6. Identify Deleted Files Still Consuming Disk Space

When a file is deleted while still open in an application (such as an active log file), the disk space is not freed until the process closes it. To find these unlinked files:

lsof +L1

The +L1 flag instructs lsof to show open files that have a hard-link count of less than 1. Restarting or terminating the listed PID frees the trapped disk space.