lsof Command in Linux

Introduction to lsof: Your Linux System's Open File Detective

In this hands-on lab, we'll explore the lsof command, a vital tool for any systemadmin. lsof, short for "list open files," provides insights into open files and active network connections within your Linux environment. It's a powerful utility that reveals which processes are utilizing specific files, including details like file descriptors, file types, associated devices, and file names.

This lab focuses on three key areas: grasping the fundamentals of the lsof command, pinpointing open files linked to particular processes, and identifying network connections using lsof. You'll develop the ability to decipher lsof output and employ diverse options to refine your search results. As part of the System Monitoring and Management curriculum, this lab enhances your system administration and troubleshooting expertise.

Demystifying the lsof Command

This section introduces the lsof command, or "list open files." As a crucial Linux tool, lsof enables you to determine which processes are holding open files and maintaining network connections.

Let's begin by executing the lsof command without any arguments:

sudo lsof

Example output:

COMMAND     PID   TID     USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd       1             root  cwd       DIR                8,1      4096          2 /
systemd       1             root  rtd       DIR                8,1      4096          2 /
systemd       1             root  txt       REG                8,1   1428176     655360 /usr/lib/systemd/systemd
systemd       1             root  mem       REG                8,1   2067688     655361 /usr/lib/x86_64-linux-gnu/libc-2.35.so
...

The lsof command generates extensive data about open files and network connections on your system. Let's analyze the column definitions:

  • COMMAND: The name of the process accessing the open file.
  • PID: The process identification number (ID).
  • TID: The thread ID (if applicable for multithreaded processes).
  • USER: The user account owning the process.
  • FD: The file descriptor, a numerical identifier for the open file.
  • TYPE: The type of file opened (e.g., regular file, directory, socket).
  • DEVICE: The device where the file system resides.
  • SIZE/OFF: The file size or offset.
  • NODE: The file's inode number.
  • NAME: The filename or network connection details.

Given the potentially large volume of output, filtering is crucial. To view open files associated with a specific process, use the -p option followed by the PID:

sudo lsof -p 1

This command displays all open files for process ID 1, usually the systemd process.

Alternatively, you can search for open files belonging to a particular user:

sudo lsof -u labex

This will list all open files owned by the user labex.

The next section will guide you through identifying open files tied to specific processes.

How to: Identify Open Files by Process

This section explains how to utilize the lsof command to identify open files associated with a particular process.

First, determine the process ID (PID) of the target process using the ps command:

sudo ps -ef | grep nginx

Example output:

root         825       1  0 14:32 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data    826     825  0 14:32 ?        00:00:00 nginx: worker process
www-data    827     825  0 14:32 ?        00:00:00 nginx: worker process

In this example, the nginx master process has a PID of 825.

Now, use lsof to list all open files linked to this process:

sudo lsof -p 825

Example output:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
nginx   825 root  cwd    DIR  253,0     4096 1048576 /usr/sbin
nginx   825 root  rtd    DIR  253,0     4096       2 /
nginx   825 root  txt    REG  253,0   977528 1048577 /usr/sbin/nginx
nginx   825 root  mem    REG  253,0  2067688 1048578 /usr/lib/x86_64-linux-gnu/libc-2.35.so
nginx   825 root  mem    REG  253,0   169032 1048579 /usr/lib/x86_64-linux-gnu/ld-2.35.so
nginx   825 root    0u   CHR  136,0      0t0       3 /dev/pts/0
nginx   825 root    1u   CHR  136,0      0t0       3 /dev/pts/0
nginx   825 root    2u   CHR  136,0      0t0       3 /dev/pts/0

This output reveals all open files associated with the nginx process, including the executable, shared libraries, and standard input/output/error streams.

Remember, you can also use lsof to find open files by user. The following command displays all open files for the labex user:

sudo lsof -u labex

This is invaluable for diagnosing issues and understanding user activity on the system.

Next, you'll learn how to identify network connections using the lsof command.

Discovering Network Connections with lsof

This section explains how to use the lsof command to identify network connections on your system, a key skill for any systemadmin.

To list all active network connections, use the lsof command with the -i option:

sudo lsof -i

Example output:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd      824 root   3u  IPv4  18620      0t0  TCP *:22 (LISTEN)
sshd      824 root   4u  IPv6  18622      0t0  TCP *:22 (LISTEN)
nginx    825 root   6u  IPv4  18650      0t0  TCP *:80 (LISTEN)
nginx    826 www-data 6u IPv4  18650      0t0  TCP *:80 (LISTEN)
nginx    827 www-data 6u IPv4  18650      0t0  TCP *:80 (LISTEN)

This output details all network connections, including sshd listening on port 22 (SSH) and nginx listening on port 80 (HTTP).

You can refine the output to show only specific types of connections. For example, to display only TCP connections:

sudo lsof -i TCP

Example output:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd      824 root   3u  IPv4  18620      0t0  TCP *:22 (LISTEN)
sshd      824 root   4u  IPv6  18622      0t0  TCP *:22 (LISTEN)
nginx    825 root   6u  IPv4  18650      0t0  TCP *:80 (LISTEN)
nginx    826 www-data 6u IPv4  18650      0t0  TCP *:80 (LISTEN)
nginx    827 www-data 6u IPv4  18650      0t0  TCP *:80 (LISTEN)

You can also filter the output based on user or process. To show network connections for the labex user:

sudo lsof -i -u labex

The lsof command is an essential tool for network troubleshooting and understanding system network activity. Mastering lsof enhances your abilities as a systemadmin.

In Conclusion: Mastering lsof for System Administration

This lab provided a comprehensive introduction to the lsof command, also known as "list open files." You discovered its power in identifying processes with open files and active network connections on Linux systems. You began by understanding the command's basic output, including the columns for process name, PID, file descriptor, file type, and filename. You then learned to use the -p option to examine open files for specific processes. Finally, you explored how to leverage lsof to locate and analyze network connections on your system. By understanding and utilizing lsof, you take a major leap forward in system monitoring, management, and troubleshooting, all crucial skills for a successful career as a systemadmin.

400+ Linux Commands