The good thing about Linux is that you can easily view and manage everything, from the boot process to the installation of software packages. Here we discuss how you can use the lsof command in Linux to view open files and the processes using them. Knowing how to view this can help you understand how the system works and even take the necessary actions for specific processes.
Lsof Command
To view open files and the users or processes responsible for them, we use the lsof utility. By default, lsof is pre-installed in most distributions.
However, if you do not have it installed, you can use the package manager to install it on your system.
Debian/Ubuntu
On Debian, run the command:
sudo apt-get install lsof
Arch/Manjaro
On Manjaro and other Arch-based distributions, use pacman by running the command:
sudo pacman -S lsof
CentOS/REHL/Fedora
For CentOS and the REHL family, you can use dnf:
sudo dnf install lsof
Use lsof Command to List Open Files for a Linux Process
Like most Linux commands, the lsof utility is incredibly simple to use. Start by typing the command lsof:
sudo lsof
Once you run the command above, lsof should return information about the open files in the system.
COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME init 1 root cwd DIR 8,48 4096 2 / init 1 root rtd DIR 8,48 4096 2 / init 1 root txt REG 0,19 632048 281474976743906 /init init 1 root 0u CHR 1,3 0t0 15362 /dev/null init 1 root 1u CHR 1,3 0t0 15362 /dev/null init 1 root 2u CHR 1,3 0t0 15362 /dev/null init 1 root 3w CHR 1,11 0t0 15367 /dev/kmsg init 1 root 4u sock 0,8 0t0 22689 protocol: AF_VSOCK init 1 root 5r REG 0,4 0 4026532185 mnt init 1 root 6r REG 0,4 0 4026532201 mnt init 1 root 7r DIR 8,48 4096 240 /home/cap init 1 root 8u DIR 8,48 4096 2 / init 1 root 9u sock 0,8 0t0 21853 protocol: AF_VSOCK
Note: if you have sudo privileges, run the command with sudo to avoid “permission denied” errors on specific files.
As shown in the output above, the lsof output has the following columns:
| Column | Representation |
|---|---|
| Command | Shows the name of the process using the target file. |
| PID | The unique identifier for the process using the file. |
| TID | The column shows the thread identifier. |
| TASKCMD | The name of the task command. |
| USER | Username or UID of the user running the process. |
| FD | File descriptor of the file and modes. |
| TYPE | Node associated with the target file. |
| DEVICE | Device number separated by commas. |
| SIZE/OFF | File size in bytes of file offset size |
| NODE | Inode value of the local file. You can use the stat command to show inode information for the file. |
| NAME | Mount point of the file. |
Now that you understand what the contents of the lsof command printout represent, let us use the command to filter for specific information.
How to Filter for Specific Process
To filter for only specific files opened by the specific process, we can use either the process name or the PID value.
For example, to show files used by the firefox process, we can use the command:
sudo lsof -c firefox
The command will show all the files opened by the firefox process.
To filter by process ID, we can use the -p option and pass the process ID. You can use the top command to get the process ID of the target process.
For example, to get the PID of the firefox process, we can use the command:
sudo ps aux | grep firefox
Once you have the PID of the target process, use lsof to show the open files:
sudo lsof -p 2121
The above command will print the files opened by the process with the PID specified.
How to Filter for a Specific User
To view only the files opened by a specific user, we can use the -u flag. For example, to filter for the Debian user, use the command:
sudo lsof -u debian
How to Filter for a Specific File
Suppose you only want to know the process and the user who opened a specific file. To do this, pass the name of the file to lsof:
sudo lsof /bin/sleep
The above will only filter for the specific file and return the related information, including the user, process ID, and more.
