Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

lsof — open files and ports of processes

6 min Linux

lsof shows which process holds a file, a port, or a deleted file that is still open.

Cheat sheet

5 commands Printable version
  • sudo lsof -i :5432 -nP who's on this port
  • sudo lsof +D /dir who holds a directory
  • sudo lsof +L1 deleted but open files
  • sudo lsof -p 1234 | wc -l how many fds a process has (a leak?)
  • sudo kill $(sudo lsof -t -i:8080) kill whoever holds a port

Overview

"In Linux, everything is a file": regular files, sockets, pipes, devices. lsof (LiSt Open Files) shows which files/sockets are open and by which process. Usually needs root.

bash 
sudo lsof -i :80                  # who's listening on/holding port 80
sudo lsof /var/log/app.log        # who opened this file
sudo lsof -u alice                # what a user has open

Options

9
Option Meaning
-i [:port] network sockets (optionally by port/host)
-nP skip DNS and port-name resolution (fast, numeric)
-p PID files of a specific process
-c name processes by command name
-u user by user
+D /dir recursively, everything under a directory (what's holding the fs)
+L1 files with fewer than 1 link (deleted but still open)
-t just PIDs (for scripts: kill $(lsof -t ...))
Option What it does Example
-i [:port] Network sockets only, optionally filtered by port or host. lsof -i :80
-n Do not resolve addresses to host names (faster). lsof -i -n
-P Do not resolve port numbers to service names. lsof -i -P
-p PID Only files opened by the given process. lsof -p 1234
-c name Only processes whose command name starts with the given string. lsof -c nginx
-u user Only files opened by the given user. lsof -u alice
+D dir Recursively all files open under the directory. lsof +D /mnt/data
+L1 Files with a link count under 1 — deleted but still open. lsof +L1
-t Print only PIDs, without the other columns — handy for piping into kill. kill $(lsof -t -i:8080)

Nothing found. Try a shorter query.

Recipes

3

Common tasks

bash 
sudo lsof -i :5432                # process on a port (like ss)
sudo lsof -i -nP                  # all network sockets (no resolution)
sudo lsof -iTCP -sTCP:LISTEN -nP  # only listening TCP sockets
sudo lsof +D /mnt/data            # who holds files in a dir
sudo lsof +L1                     # deleted but still open files
sudo lsof -p 1234                 # everything process 1234 opened
sudo lsof -c nginx                # everything nginx processes opened
sudo lsof -u alice -a -i          # user alice AND network (-a = AND)
sudo kill $(sudo lsof -t -i:8080) # kill whoever is on port 8080

The FD column and locks

text 
student@ubuntu:~$ lsof /tmp/lk
COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
flock   1094 student    3rW  REG  253,4        0 2703 /tmp/lk
sleep   1096 student    3r   REG  253,4        0 2703 /tmp/lk
flock   1112 student    3r   REG  253,4        0 2703 /tmp/lk

FD is the descriptor number, then the mode: r — read, w — write, u — both. A third letter is a file lock: W — a write lock on the whole file, R — a read lock on the whole file, w and r — on part of it. Instead of a number there can be cwd (current directory), txt (program file), mem (a memory-mapped file).

Here flock 1094 holds the lock (3rW), sleep 1096 is its child with the same open file, and flock 1112 has opened the file and waits: it has no lock letter. Waiters also show in /proc/locks (see proc-filesystem).

Deleted files: +L1 and DEL

A file that was deleted or replaced with a new one lives on while a process holds it — an open unlinked file. lsof +L1 shows open files that have no name left on disk. This is a service whose binary was replaced by an update:

text 
student@ubuntu:~$ sudo lsof +L1
COMMAND    PID USER  FD   TYPE DEVICE SIZE/OFF NLINK NODE NAME
demo-slee 4214 root txt    REG  253,4    35336     0 4464
  /usr/local/bin/demo-sleep (deleted)

NLINK 0 means the file has no names; txt means it is the program file.

A deleted shared library in a process's memory does not show in +L1: such a file is not open but mapped into memory. lsof for the process marks it DEL in the FD column:

text 
student@ubuntu:~$ sudo lsof -p 3830 | grep -E 'COMMAND|DEL'
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF  NODE NAME
sleep   3830 root  DEL    REG   253,4           2727
  /usr/local/lib/libdemo.so.1

The same files marked (deleted) are in /proc/<PID>/maps (see proc-filesystem). A replaced file is freed only when the process restarts.

Troubleshooting

5

df shows "full", du doesn't

A file that's deleted but still held open by a process doesn't free its space. Find it with sudo lsof +L1 → restart the process holding it (see disk-usage).

umount: target is busy

Something is holding the filesystem: sudo lsof +D /mnt/data (or fuser -vm /mnt/data). Close the processes (or cd out of the directory) and unmount (see mount).

A port is in use, but by what?

sudo lsof -i :PORT -nP or ss -tlnp.

A process is "leaking" file descriptors

sudo lsof -p PID | wc -l shows how many are open; compare against the ulimit -n limit. Steady growth means a leak in the application.

lsof is slow

It's resolving DNS/ports/mounts — add -nP; with a stuck NFS mount it can hang on the mount itself.

Terms

1
open unlinked file
A file whose last name was removed while a process still holds it open and retains access to its data. Also appears in: unattended-upgrades: security updates with no one at the keyboard, /proc: processes and the kernel as files

See also

  • ss — Who's listening on what ports and which connections are open — the modern netstat.
  • disk-usage — Where the space and inodes went — df, du, finding large files, gotchas.
  • processes — Viewing processes, signals and priorities; finding CPU/memory hogs.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Topics
Loading…