9 practical use cases of lsof command in Linux.

The full form of lsof command is to list open files ,as Linux considers everything as a file.
lsof is used for checking which files are opened by which process this command is used in many cases for troubleshooting an issue.
In this blog, we are going to discuss the 9 practical use cases of lsof command in Linux.

Table of Contents

list all open files

The lsof the command is used to list all open files on a Linux system. This can be useful for identifying which files are currently in use, and by which processes.

lsof

If you enter lsof command alone without any parameters it will show a detailed output which has columns like COMMAND, PID, USER, FD, TYPE, NAME etc.

The command contains the first nine characters of the name of the UNIX command associated with the process.

PID – is the Process IDentification number of the process.

USER – is the user ID number or login name of the user to whom the process belongs, usually the same as reported by ps(1).

TYPE – is the type of the node associated with the file

DIR – Directory

REG – Regular file.

FIFO – First In First Out.

FD – stands for a File descriptor and may see some of the values as:.

CWD – current working directory.

RTD – root directory.

TXT – program text (code and data).List item

MEM – memory-mapped file.List item

To List, all the files opened by a specific user.

Finding all files opened by a specific user: The lsof command can be used to identify all the files that a specific user has opened on the system. This can be useful for monitoring and controlling user activity.

lsof -u username

List all the files opened by users except a particular user.

lsof -u ^ username

To list files opened by a specific command

lsof -c chrome

lsof -c ssh to see all the opened files of program ssh.

To find all processes that are running in a specific directory

The lsof the command can be used to identify all the processes that have files open in a specific directory. This can be useful for identifying and managing resource-intensive processes.

lsof D /home/directoryname

To find a process that has a particular file open

lsof /path/to/file

This command will display the process that has the specified file open.

Finding a process that is listening on a particular port:

lsof -i TCP:80

Here as per the output, we can determine Nginx is listening on port 80

To list all open files of a specific device

lsof /dev/nvme0n1p5

It will give you a list of processes that have the specified device open and information about each process such as the process ID (PID), the user running the process, and the type of access the process has to the device (e.g. read, write).

Detecting and diagnosing memory leaks

lsof -m

This command will list all files that are currently mapped into a process’s memory.

To list the files opened by a specific PID

lsof -p <PID>

This command will list all the files that the specified process (by PID) has open.

Keep in mind that the lsof command must be run with root or superuser permissions to get the full list of open files in the system, as regular users can only see the open files to which they have access.

Summary:

In this blog, we have discussed the 9 practical use cases of lsof command.further details can be read from the man page of lsof command.
https://man7.org/linux/manpages/man8/lsof.8.html