This guide will explain how to get a list of open files, sockets and pipes in Linux using the lsof command.
lsof is a very powerful Linux command line tool. It ships with just about every Linux distribution and gives you a list of open files, sockets, and pipes.
The most basic usage of the tool is to type the command name followed by the Return key, # lsof. This command should return a rather long list. A better way to run this command is with the less command – # lsof | less
Using lsof along with less allows you to scroll through the output both up and down, making it easier to read. Of course, the command can do a lot more than just give you a general output of all open files. It can be a life saver in situations where you are troubleshooting an issue.
For example, you can have lsof give you a list of all the open files which have been opened by a particular process. First, get the process ID using the # ps -ef command. Then run the command # lsof -p 30646. The -p stands for process ID, and 30646 is an example process Id which you should replace with your process ID.
You can also search for all the open files, sockets, etc from a certain part of your system. So, if you want to see all the files from the /mnt directory, run the command # lsof /mnt. Or, if you want to find all the process opened by a particular command, execute a line like # lsof -c mysql, where -c stands for “command”, and you can replace mysql with the command you whose files you want to check on:
Linux treats ports, sockets, and devices as files. You can also search for all the all connections using a certain protocol or even a port. You can search for all the currently running SSH connections to your machine using the command # lsof -i :22. Or if you want to see all the tcp connections on your computer run the command # lsof -i TCP:
lsof is a pretty smart command with several other options. Check out the tool’s man page for more information on how to maximize it’s use.
