Checking On Open Files and Sockets with lsof

Have you ever tried to umount a filesystem, only to find that some process was still using it?

[root@host]# umount /mnt umount: /mnt: device is busy

To quickly hunt down what processes are still using /mnt, try the lsof tool:

[root@host]# lsof /mnt COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME bash 30951 rob cwd DIR 7,0 1024 2 /mnt

Ah, apparently rob is cd'd to /mnt (since his bash process has it set as its cwd). lsof will list all open files, directories, libraries, sockets, and devices associated with a particular process. In the above example, we specified a mount point and had lsof show us the associated processes. To do the reverse (show files associated with a PID), use the -p switch:

[root@host]# lsof -p 30563

If you'd rather specify the process by name, use -c:

[root@host]# lsof -c syslogd

You can also specify special devices on the command line. For example, let's see what the user on pts/0 is up to:

[root@host]# lsof /dev/pts/0

If you need to specify multiple switches, they are ORed with each other by default. To require all switches (that is, to AND them) include the -a flag on each switch you want to AND. For example, to see all of the open files associated with vi processes that rob is running, try this:

[root@host]# lsof -u rob -ac vi

If you'd like to examine open sockets and their associated processes (like a netstat -p), try the -i switch:

[root@host]# lsof -i

Or to see what files are open using TCP on port 21 run:

[root@host]# lsof -i TCP:21

Note that you must be root to run lsof for many functions, including retrieving open socket information. lsof is a complex and very flexible tool, giving you as much (or as little) detail as you need about what files are in use by every running process on your system.