Assisting 13514254 developers since 2005.

Web Developer, Open Source, Loyal, Dad.  

Read More »

What is lsof Command in Linux?

Posted by David  •  Oct 21st, 2014 10:48:15 pm - Subscribe | Mood: spazzy |

This entry explains the user] of the lsof command which stands for, List of Open Files...this can be really useful if you would like to see what files are currently running for the instance of a particular user.

When running lsof it is always a good idea to specify what you are actually looking for, simply running lsof will give you a slew of data much of it will not be useful to you, especially if you are trying to stop a command that is you to properly administer your linux system.

If you can remember I created an entry called Lost Disk Space on Linux Due to Stop Command. In which I was backing up some critical web dev files, not realizing that I was going to be running out of disk. Take a look at that entry, it gives resolution along with the proper use of the lsof command when things go wrong.

Here are a couple of lsof commands that you can use that will help you make heads or tales of what process is doing what, at what time, and at what location.

  • What process is running on what port: lsof -i tcp:80
    quote:
    Output
    COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
    apache2 2493 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    apache2 2586 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    apache2 2587 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    apache2 13376 root 5u IPv6 2015771 0t0 TCP *:http (LISTEN)


  • List all network connections that are listening and established: lsof -i
    quote:
    Output
    COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
    rpcbind 1495 root 6u IPv4 2196 0t0 UDP *:sunrpc
    rpcbind 1495 root 7u IPv4 2199 0t0 UDP *:820
    rpcbind 1495 root 8u IPv4 2200 0t0 TCP *:sunrpc (LISTEN)
    rpcbind 1495 root 9u IPv6 2203 0t0 UDP *:sunrpc
    rpcbind 1495 root 10u IPv6 2217 0t0 UDP *:820
    rpcbind 1495 root 11u IPv6 2218 0t0 TCP *:sunrpc (LISTEN)
    rpc.statd 1527 statd 4u IPv4 2263 0t0 UDP localhost:855
    rpc.statd 1527 statd 7u IPv4 2272 0t0 UDP *:45172
    rpc.statd 1527 statd 8u IPv4 2276 0t0 TCP *:34261 (LISTEN)
    rpc.statd 1527 statd 9u IPv6 2280 0t0 UDP *:39721
    rpc.statd 1527 statd 10u IPv6 2284 0t0 TCP *:58694 (LISTEN)
    sshd 2322 root 3u IPv4 2461758 0t0 TCP 192.168.1.111:ssh->192.171.117.210:60932 (ESTABLISHED)
    apache2 2493 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    ntpd 2574 ntp 16u IPv4 3329 0t0 UDP *:ntp
    ntpd 2574 ntp 17u IPv6 3330 0t0 UDP *:ntp
    ntpd 2574 ntp 18u IPv4 3337 0t0 UDP localhost:ntp
    ntpd 2574 ntp 19u IPv4 3338 0t0 UDP 192.168.1.111:ntp
    ntpd 2574 ntp 20u IPv6 3339 0t0 UDP ip6-localhost:ntp
    ntpd 2574 ntp 21u IPv6 3340 0t0 UDP [fd08:46b3:7999:0:ba27:ebff:fe98:69d7]:ntp
    ntpd 2574 ntp 22u IPv6 3341 0t0 UDP [2605:6000:170c:400b:ba27:ebff:fe98:69d7]:ntp
    ntpd 2574 ntp 23u IPv6 3342 0t0 UDP [fe80::ba27:ebff:fe98:69d7]:ntp
    apache2 2586 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    apache2 2586 www-data 25u IPv6 2470006 0t0 TCP 192.168.1.111:http->c-98-204-186-50.hsd1.md.comcast.net:62561 (FIN_WAIT2)
    apache2 2587 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    miniserv. 2675 root 6u IPv4 156038 0t0 TCP *:55500 (LISTEN)
    miniserv. 2675 root 7u IPv4 156039 0t0 UDP *:55500
    master 2776 root 12u IPv4 3758 0t0 TCP *:smtp (LISTEN)
    master 2776 root 13u IPv6 3760 0t0 TCP *:smtp (LISTEN)
    apache2 13376 root 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    mysqld 19639 mysql 4u IPv4 501203 0t0 TCP localhost:mysql (LISTEN)
    sshd 21336 root 3u IPv4 502704 0t0 TCP *:ssh (LISTEN)
    sshd 21336 root 4u IPv6 502706 0t0 TCP *:ssh (LISTEN)
    sshd 32495 root 3u IPv4 2288516 0t0 TCP 192.168.1.111:ssh->192.168.1.102:56131 (ESTABLISHED)


  • What user is viewing a specific command or file: lsof -i -u david
    quote:
    Output
    COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
    rpcbind 1495 root 6u IPv4 2196 0t0 UDP *:sunrpc
    rpcbind 1495 root 7u IPv4 2199 0t0 UDP *:820
    rpcbind 1495 root 8u IPv4 2200 0t0 TCP *:sunrpc (LISTEN)
    rpcbind 1495 root 9u IPv6 2203 0t0 UDP *:sunrpc
    rpcbind 1495 root 10u IPv6 2217 0t0 UDP *:820
    rpcbind 1495 root 11u IPv6 2218 0t0 TCP *:sunrpc (LISTEN)
    rpc.statd 1527 statd 4u IPv4 2263 0t0 UDP localhost:855
    rpc.statd 1527 statd 7u IPv4 2272 0t0 UDP *:45172
    rpc.statd 1527 statd 8u IPv4 2276 0t0 TCP *:34261 (LISTEN)
    rpc.statd 1527 statd 9u IPv6 2280 0t0 UDP *:39721
    rpc.statd 1527 statd 10u IPv6 2284 0t0 TCP *:58694 (LISTEN)
    sshd 2322 root 3u IPv4 2461758 0t0 TCP 192.168.1.111:ssh->192.171.117.210:60932 (ESTABLISHED)
    apache2 2493 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    ntpd 2574 ntp 16u IPv4 3329 0t0 UDP *:ntp
    ntpd 2574 ntp 17u IPv6 3330 0t0 UDP *:ntp
    ntpd 2574 ntp 18u IPv4 3337 0t0 UDP localhost:ntp
    ntpd 2574 ntp 19u IPv4 3338 0t0 UDP 192.168.1.111:ntp
    ntpd 2574 ntp 20u IPv6 3339 0t0 UDP ip6-localhost:ntp
    ntpd 2574 ntp 21u IPv6 3340 0t0 UDP [fd08:46b3:7999:0:ba27:ebff:fe98:69d7]:ntp
    ntpd 2574 ntp 22u IPv6 3341 0t0 UDP [2605:6000:170c:400b:ba27:ebff:fe98:69d7]:ntp
    ntpd 2574 ntp 23u IPv6 3342 0t0 UDP [fe80::ba27:ebff:fe98:69d7]:ntp
    apache2 2586 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    apache2 2587 www-data 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    miniserv. 2675 root 6u IPv4 156038 0t0 TCP *:55500 (LISTEN)
    miniserv. 2675 root 7u IPv4 156039 0t0 UDP *:55500
    master 2776 root 12u IPv4 3758 0t0 TCP *:smtp (LISTEN)
    master 2776 root 13u IPv6 3760 0t0 TCP *:smtp (LISTEN)
    apache2 13376 root 5u IPv6 2015771 0t0 TCP *:http (LISTEN)
    mysqld 19639 mysql 4u IPv4 501203 0t0 TCP localhost:mysql (LISTEN)
    sshd 21336 root 3u IPv4 502704 0t0 TCP *:ssh (LISTEN)
    sshd 21336 root 4u IPv6 502706 0t0 TCP *:ssh (LISTEN)
    sshd 32495 root 3u IPv4 2288516 0t0 TCP 192.168.1.111:ssh->192.168.1.102:56131 (ESTABLISHED)


    Well I hope this brief snippet of information shows you how useful the lsof command can be, if you have any commands that you would like to share, leave a comment below.

    Comments 0  •  Oct 21st, 2014 10:48:15 pm - Subscribe  •  Tweet this entry | Post a comment



  • Responses

    Leave a Reply


    ReCaptcha:

    Posting as anonymous Anonymous guest, why not register, or login now.

    Image Gallery

    Badges

    Amazon Wishlist Stumble Upon Toolbar
    Internet Blogs - Blog Top Sites Internet Blogs - Blog Top Sites Technology

    About Me

    avatar

    @davidpolanco
    iPhone: 29.513522,-98.565523 Web Designer, Open Source, Loyal, Dad. Learn more...