The lsof Command in Linux with Examples

What is lsof

lsof means "list open files". In Linux almost everything is a file: regular files, folders, devices and network sockets. lsof shows which process opened which file. It helps you find what uses a port, why a disk cannot unmount, and who locks a file.

Install lsof

Debian and Ubuntu:

sudo apt install lsof

Red Hat, CentOS, AlmaLinux:

sudo yum install lsof

Arch:

sudo pacman -S lsof

Syntax

lsof [options] [file ...]

Run it with sudo to see files of all users.

Examples

List all open files

sudo lsof

The output is long. Pipe it to less or head.

Files opened by a user

lsof -u username

lsof -u root

Files opened by a process

lsof -p PID

lsof -p 1234

Open files in a directory

lsof +D /path/to/directory

lsof +D /var/log

Network connections

lsof -i

TCP only:

lsof -i tcp

Who uses port 80:

sudo lsof -i :80

Files opened by a command

lsof -c command

lsof -c sshd

Files on a device or mount

lsof /dev/sda1

or, for everything on a mounted file system:

lsof /mnt/data

Useful tips

• Find deleted files that still use disk space: sudo lsof | grep deleted.
• Combine filters with -a (AND): lsof -a -u root -i.
• Use -t to print only the PIDs, for example kill $(lsof -t -i :8080).
• Use -n -P to skip host and port name lookups for faster output.

Quick recap

• lsof -i :PORT shows what uses a port.
• lsof -u user and lsof -p PID filter by user and process.