YouTip

[ Linux Command Manual](#) * * * A powerful command-line tool used to list all open files and related process information on the current system. In Linux, the philosophy that "everything is a file" means lsof can display not only regular files but also network connections, device files, pipes, sockets, and more. * * * ## lsof Basic Syntax lsof ### Common Option Parameter Descriptions | Option | Description | | --- | --- | | `-a` | Use AND logic to combine multiple conditions | | `-c ` | Display files opened by the specified process | | `-d ` | Display files with the specified file descriptor | | `-i` | Display network connection related information | | `-n` | Do not resolve hostnames (display IP addresses) | | `-P` | Do not resolve port names (display port numbers) | | `-p ` | Display files opened by the specified process ID | | `-u ` | Display files opened by the specified user | | `+D ` | Recursively display files opened under the directory | | `-t` | Output only process IDs (suitable for script use) | * * * ## Common Usage Examples ### 1. View all open files lsof This lists all open files in the system, including regular files, directories, library files, devices, and network connections. ### 2. View files opened by a specified process ## Example lsof -p 1234# View files opened by the process with PID 1234 lsof -c nginx # View files opened by all nginx processes ### 3. View network connections ## Example lsof -i# View all network connections lsof -i :80# View all connections using port 80 lsof -i TCP # View all TCP connections ### 4. View files opened by a user lsof -u root # View files opened by the root user ### 5. Find files that are deleted but still held by processes lsof | grep deleted This situation commonly occurs when log files are deleted but the service is still running, preventing disk space from being freed. ### 6. View files opened under a specified directory lsof +D /var/log # View files opened under the /var/log directory * * * ## Output Field Explanations Typical columns in the lsof command output are: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME * **COMMAND**: Process name * **PID**: Process ID * **USER**: User running the process * **FD**: File Descriptor * `cwd`: Current working directory * `txt`: Program code file * `mem`: Memory-mapped file * `0u`, `1u`, `2u`: Standard input, output, error * **TYPE**: File type (REG regular file, DIR directory, CHR character device, etc.) * **DEVICE**: Device number * **SIZE/OFF**: File size or offset * **NODE**: File inode number * **NAME**: Filename or mount point * * * ## Advanced Application Scenarios ### 1. Find the process occupying a port lsof -i :8080 When you want to start a service but the port is already in use, this command quickly finds the process occupying the port. ### 2. Recover deleted files When a file is deleted but still in use by a process, it can be recovered via the /proc filesystem: ## Example lsof |grep deleted # Find the deleted file and its process ls-l/proc//fd # View the process's file descriptors cp/proc//fd//path/to/recovery # Recover the file ### 3. Monitor file access watch -n 1 'lsof /path/to/file' This can monitor in real-time which processes are accessing a specific file. * * * ## Common Problem Solving ### 1. Disk space is low but large files cannot be found lsof | grep deleted Find files that are deleted but still held by processes, then restart the relevant processes to free space. ### 2. Unable to unmount a device lsof /mount/point Find which processes are using the mount point, close these processes, and then unmount. ### 3. Troubleshooting network connection issues lsof -i -n -P View all network connections to help troubleshoot port conflicts or connection problems. * * * ## Performance Considerations Although lsof is powerful, be cautious when using it in busy production environments: 1. Running `lsof` directly scans the entire system and may consume significant resources 2. Try to use precise filter conditions (like `-p`, `-u`, `-i`, etc.) to narrow the query scope 3. Use the `-t` option in scripts to output only PIDs, reducing parsing overhead * * * ## Alternative Tools Although lsof is the most commonly used tool, consider these in certain scenarios: 1. **fuser**: Quickly check which processes are using a specific file or socket 2. **ss/netstat**: Specifically for network connection information 3. **ps**: Combined with the `/proc` filesystem, it can also obtain some information * * * ## Summary lsof is the Swiss Army knife for Linux system administrators and developers. Mastering it helps you: 1. Quickly locate resource usage issues 2. Troubleshoot file and network-related problems 3. Understand system running status 4. Solve various "file in use" problems It is recommended to practice more in daily work, flexibly use various options and parameters according to specific scenarios, and gradually master the full potential of this powerful tool. * * Linux Command Manual](#)