__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

lsof Cheatsheet

← Back to cheatsheets

← Home

lsof (list open files) shows information about files opened by processes. Lists open files, network connections, and file descriptors. Essential for debugging and system administration.

Basic Usage

  • lsof - List all open files
  • lsof -p PID - Files by process
  • lsof -u user - Files by user
  • lsof file - Processes using file
  • lsof -i - Network connections

Process Selection

  • -p PID - Process ID
  • -p PID1,PID2 - Multiple PIDs
  • -p ^PID - Exclude PID
  • -c command - Command name
  • -u user - Username
  • -u ^user - Exclude user

File Selection

  • lsof file - Specific file
  • lsof +D directory - Directory
  • lsof +d directory - Directory (non-recursive)
  • -a - AND conditions
  • -t - Show only PIDs

Network Options

  • -i - All network connections
  • -i TCP - TCP connections
  • -i UDP - UDP connections
  • -i :port - Specific port
  • -i @host - Specific host
  • -i @host:port - Host and port
  • -i TCP:port - TCP on port
  • -i UDP:port - UDP on port

Output Options

  • -F - Field output
  • -l - Show login names
  • -n - No hostname resolution
  • -P - No port name resolution
  • -t - PID only
  • -w - Suppress warnings
  • -V - Version

Common Examples

Process Files

lsof -p 1234

Files opened by process.

User Files

lsof -u username

Files opened by user.

File Usage

lsof /path/to/file

Processes using file.

Network Connections

lsof -i

All network connections.

Port Usage

lsof -i :80

Process using port 80.

TCP Connections

lsof -i TCP

All TCP connections.

Specific Host

lsof -i @192.168.1.1

Connections to/from host.

Command Files

lsof -c firefox

Files opened by command.

Directory Files

lsof +D /var/log

Files in directory.

PID Only

lsof -t -i :80

Get PID using port.

Tips

  • Use -i for network troubleshooting
  • Use -t to get PIDs for scripts
  • Use -n and -P for faster output
  • Combine with kill to free resources
  • Use -a to combine conditions
  • Essential for debugging file locks
  • Great for finding port conflicts
  • Useful for security auditing