Open files in Linux: the lsof command

lsof (list open files) shows which files and sockets are open and by which process.

Syntax

lsof [options]

Common cases

lsof -p 1234            # what process 1234 has open
lsof /var/log/syslog    # who holds this file
sudo lsof -i :80        # who took port 80
sudo lsof -i            # all network connections
lsof +D /home/user      # all open files under a directory

How it works: in Linux almost everything is a file

In Linux a regular file, a socket, a pipe and a device are all 'open files' to a process. So lsof answers many questions at once: who took a network port (-i :port), why a disk will not unmount (which process holds a file on it), where space went (a deleted but still-open file frees no space - it shows up in lsof). The same data lives in /proc/<PID>/fd, and lsof just gathers it into a readable form.

In the book

This topic is covered in full in the chapter Monitoring and bottlenecks.

See also

Sockets: ss, Viewing processes, The /proc filesystem.