How To Use lsof Command

lsof is one of these super useful Linux commands that is still not installed on most distros by default, but it's definitely part of common repositories so can easily be installed. lsof shows files, sockets and network sockets (including TCP/UDP ports) opened on your OS.

Use lsof for a Specific Process

Most often you run lsof against a specific process ID – meaning that lsof shows you just the files/sockets opened by that process.

For example, I have a process with vim editor, working on the next update to my tmux config file:

501 75010 74939 0 Thu02pm ttys006 0:00.16 vim .tmux.conf

Using the process ID of this vim session, 75010, I can use lsof to see what's going on:

greys@maverick:~ $ lsof -p 75010
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
vim 75010 greys cwd DIR 1,4 4896 570825 /Users/greys
vim 75010 greys txt REG 1,4 1863696 110389591 /usr/bin/vim
vim 75010 greys txt REG 1,4 973824 110389688 /usr/lib/dyld
vim 75010 greys 0u CHR 16,6 0t17727 1289 /dev/ttys006
vim 75010 greys 1u CHR 16,6 0t17727 1289 /dev/ttys006
vim 75010 greys 2u CHR 16,6 0t17727 1289 /dev/ttys006
vim 75010 greys 4u REG 1,4 12288 115934590 /Users/greys/.tmux.conf.swp

As you can see, this shows that we have a file descriptor open for my current working directory /Users/greys, we have the vim editor binary along with dynamic loader dyld, a few instances of accessing my virtual console (/dev/ttys006) and, finally, the temporary file with tmux.conf changes: /Users/greys/.tmux.conf.swp.

INTERESTING: Just like any sensible editor would do, vim doesn't actually keep changing the file you're editing – instead it's collecting changes in that swap file (.tmux.conf.swp) until we finish and choose to commit changes or exit the vim editor. Then it will apply the changes to the actual file I'm trying to change.

See Also

• Useful Unix Commands
• Linux commands
• lsof command
• Basic Unix Commands
• Process Tree

Liked it? Take a second to support Gleb Reys on Patreon!