15+ lsof command examples in Linux [Cheat Sheet]

CheatSheet

Author: Rohan Timalsina
Reviewer: Deepak Prasad

Introduction to lsof command

lsof means list open files, thus it provides a list of files that are opened by processes in the Linux system. It does not list only regular files. An open file can also be a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket.)

 

Different examples to use lsof command

When lsof command is used without any option, it lists all open files belonging to all active processes. The basic syntax of lsof command is:

$ lsof [option] [names]

In this article, we will go through some of the lsof command examples in the Linux system.

 

1. lsof command to list all open files

The lsof command displays all open files that are opened by processes in the system.

$ lsof

Sample Output:

ubuntu@golinux:~$ lsof
COMMAND    PID  TID             USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
systemd      1                  root  cwd       DIR              253,0      4096          2 /
systemd      1                  root  rtd       DIR              253,0      4096          2 /
systemd      1                  root  txt       REG              253,0   1620224     821084 /lib/systemd/systemd
systemd      1                  root  mem       REG              253,0   1369352     820667 /lib/x86_64-linux-gnu/libm-2.31.so
systemd      1                  root  mem       REG              253,0    178528     787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd      1                  root  mem       REG              253,0   1575112     260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd      1                  root  mem       REG              253,0    137584     820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd      1                  root  mem       REG              253,0     43312     788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1
systemd      1                  root  mem       REG              253,0     34872     272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0
...

lsof displays the following information in the output.

  • COMMAND: It contains the first nine characters of the name of the UNIX command associated with the process.
  • PID: It is the Process IDentification number of the process.
  • USER: It contains the user ID number or login name of the user to whom the process belongs.
  • FD: It is the File Descriptor number of the file.
  • TYPE: It is the type of node associated with the file - e.g., GDIR, GREG, VDIR, VREG, etc.
  • DEVICE: It contains the device numbers, separated by commas, for a directory or NFS file, or 'memory' for memory file, etc.
  • SIZE, SIZE/OFF, or OFFSET: It is the size of the file or the file offset in bytes. A value is displayed in this column only if it is available.
  • NODE: It includes the node number of a local file, inode number of an NFS file, the Internet protocol type - e. g, ''TCP'', etc.
  • NAME: It contains the name of the mount point and file system on which the file resides or the local and remote Internet addresses of a network file.

 

2. List files opened by specific user with lsof command

You can use -u option to specify users with login names or user ID. It helps to display all files opened by specified user.

$ lsof -u username

OR

$ lsof -u userID

Sample Output:

deepak@ubuntu:~$ lsof -u deepak | less
COMMAND    PID   USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd   2035 deepak  cwd       DIR              253,0     4096          2 /
systemd   2035 deepak  rtd       DIR              253,0     4096          2 /
systemd   2035 deepak  txt       REG              253,0  1620224     821084 /lib/systemd/systemd
systemd   2035 deepak  mem       REG              253,0  1369352     820667 /lib/x86_64-linux-gnu/libm-2.31.so
systemd   2035 deepak  mem       REG              253,0   178528     787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd   2035 deepak  mem       REG              253,0  1575112     260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd   2035 deepak  mem       REG              253,0   137584     820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd   2035 deepak  mem       REG              253,0    43312     788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1
systemd   2035 deepak  mem       REG              253,0    34872     272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0
systemd   2035 deepak  mem       REG              253,0   432640     788554 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1
systemd   2035 deepak  mem       REG              253,0    30936     805442 /lib/x86_64-linux-gnu/libuuid.so.1.3.0
systemd   2035 deepak  mem       REG              253,0    18680     788340 /lib/x86_64-linux-gnu/libattr.so.1.1.0

You can also specify multiples users by comma-separated set - e.g., ''abe'', or ''548,root''.

 

3. Exclude a specific user with lsof command

To exclude a particular user when listing opened files, you can use ^ character in front of a username.

$ lsof -u ^user

Sample Output:

For example, to exclude a user 'deepak, you can use:

root@ubuntu:~# lsof -u ^deepak | less
COMMAND    PID  TID             USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
systemd      1                  root  cwd       DIR              253,0      4096          2 /
systemd      1                  root  rtd       DIR              253,0      4096          2 /
systemd      1                  root  txt       REG              253,0   1620224     821084 /lib/systemd/systemd
systemd      1                  root  mem       REG              253,0   1369352     820667 /lib/x86_64-linux-gnu/libm-2.31.so
systemd      1                  root  mem       REG              253,0    178528     787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd      1                  root  mem       REG              253,0   1575112     260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd      1                  root  mem       REG              253,0    137584     820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd      1                  root  mem       REG              253,0     43312     788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1
systemd      1                  root  mem       REG              253,0     34872     272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0
systemd      1                  root  mem       REG              253,0    432640     788554 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1
...

 

4. Avoid kernel functions with lsof command

-b option causes lsof to avoid kernel functions that might block - namely, lstat, readlink, and stat.

$ lsof -b

Sample Output:

ubuntu@golinux:~$ lsof -b
COMMAND    PID  TID             USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
systemd      1                  root  cwd       DIR              253,0      4096          2 /
systemd      1                  root  rtd       DIR              253,0      4096          2 /
systemd      1                  root  txt       REG              253,0   1620224     821084 /lib/systemd/systemd
systemd      1                  root  mem       REG              253,0   1369352     820667 /lib/x86_64-linux-gnu/libm-2.31.so
systemd      1                  root  mem       REG              253,0    178528     787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd      1                  root  mem       REG              253,0   1575112     260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd      1                  root  mem       REG              253,0    137584     820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd      1                  root  mem       REG              253,0     43312     788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1
systemd      1                  root  mem       REG              253,0     34872     272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0
...

 

5. lsof command to find files opened by specific process

-c option helps to list the files opened by processes that start with specified characters.

$ lsof -c character

Sample Output:

The following commmand only displays the processes that start with net.

lsof command list opened files by specific process

 

6. Search for all open files of directory using lsof command

+D option tells lsof to search for all opened files in specified directory dir and all the files and directories it contains to its complete depth.

$ lsof +D dir

Sample Output:

lsof command to find opened files in directory

 

7. List all IPv4 and IPv6 connections with lsof command

Generally, -i option is used to list opened files by any of whose Internet address matches the specified address. If -i4 or -i6 is specified with no following address, only files of the indicated IP version, IPv4 or IPv6, are displayed.

IPv4:

$ lsof -i4

IPv6:

$ lsof -i6

Sample Output:

ubuntu@golinux:~$ lsof -i4
COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
GeckoMain 3636 ubuntu   99u  IPv4  64553      0t0  TCP 10.0.2.15:37570->239.237.117.34.bc.googleusercontent.com:https (ESTABLISHED)
GeckoMain 3636 ubuntu  100u  IPv4  64572      0t0  TCP 10.0.2.15:54270->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)
GeckoMain 3636 ubuntu  107u  IPv4  64907      0t0  TCP 10.0.2.15:52508->82.221.107.34.bc.googleusercontent.com:http (ESTABLISHED)
GeckoMain 3636 ubuntu  109u  IPv4  64944      0t0  TCP 10.0.2.15:54280->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)
GeckoMain 3636 ubuntu  121u  IPv4  65954      0t0  TCP 10.0.2.15:44478->133.247.244.35.bc.googleusercontent.com:https (ESTABLISHED)
GeckoMain 3636 ubuntu  128u  IPv4  64985      0t0  UDP localhost:47649->localhost:domain 
GeckoMain 3636 ubuntu  149u  IPv4  65958      0t0  TCP 10.0.2.15:59234->ec2-35-82-131-108.us-west-2.compute.amazonaws.com:https (ESTABLISHED)

 
ubuntu@golinux:~$ lsof -i6
COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
GeckoMain 3636 ubuntu   97u  IPv6  64541      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:59476->[2600:1901:0:38d7::]:http (ESTABLISHED)
GeckoMain 3636 ubuntu  108u  IPv6  64908      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:59488->[2600:1901:0:38d7::]:http (ESTABLISHED)
GeckoMain 3636 ubuntu  114u  IPv6  64921      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:59974->[2400:1a00:cd11:a112::67d3:9543]:http (ESTABLISHED)
GeckoMain 3636 ubuntu  119u  IPv6  66020      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:46360->bom12s16-in-x03.1e100.net:http (ESTABLISHED)
GeckoMain 3636 ubuntu  142u  IPv6  65406      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:49826->text-lb.eqsin.wikimedia.org:https (ESTABLISHED)

An Internet address can be specified in the form:

[46][protocol][@hostname|hostaddr][:service|port]

Here,

  • 46: It specifies the IP version, IPv4 or IPv6.
  • protocol: - A protocol name - TCP, UDP.
  • hostname: - an Internet host name.
  • hostaddr:  A numeric Internet address.
  • service: /etc/services name - e.g., smtp - or a list of them.
  • port: port number, or a list of them.

 

8.  List all TCP connections using lsof command

You can view the files that are used by TCP with -i option.

$ lsof -i TCP

Sample Output:

 

ubuntu@golinux:~$ lsof -i TCP
COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
GeckoMain 3636 ubuntu   52u  IPv4  68529      0t0  TCP 10.0.2.15:54328->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)
GeckoMain 3636 ubuntu   97u  IPv6  64541      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:59476->[2600:1901:0:38d7::]:http (ESTABLISHED)
GeckoMain 3636 ubuntu   99u  IPv4  64553      0t0  TCP 10.0.2.15:37570->239.237.117.34.bc.googleusercontent.com:https (ESTABLISHED)
GeckoMain 3636 ubuntu  100u  IPv4  64572      0t0  TCP 10.0.2.15:54270->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)
GeckoMain 3636 ubuntu  107u  IPv4  64907      0t0  TCP 10.0.2.15:52508->82.221.107.34.bc.googleusercontent.com:http (ESTABLISHED)
GeckoMain 3636 ubuntu  108u  IPv6  64908      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:59488->[2600:1901:0:38d7::]:http (ESTABLISHED)
GeckoMain 3636 ubuntu  109u  IPv4  64944      0t0  TCP 10.0.2.15:54280->server-13-227-138-72.bom50.r.cloudfront.net:https (ESTABLISHED)
GeckoMain 3636 ubuntu  114u  IPv6  64921      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:59974->[2400:1a00:cd11:a112::67d3:9543]:http (ESTABLISHED)
GeckoMain 3636 ubuntu  115u  IPv4  68516      0t0  TCP 10.0.2.15:58622->ec2-44-226-241-1.us-west-2.compute.amazonaws.com:https (ESTABLISHED)
GeckoMain 3636 ubuntu  117u  IPv4  68504      0t0  TCP 10.0.2.15:47994->117.18.237.29:http (ESTABLISHED)
GeckoMain 3636 ubuntu  119u  IPv6  66020      0t0  TCP 2400-1A00-B050-ip6.wlink.com.np:46360->bom12s16-in-x03.1e100.net:http (ESTABLISHED)
GeckoMain 3636 ubuntu  121u  IPv4  65954      0t0  TCP 10.0.2.15:44478->133.247.244.35.bc.googleusercontent.com:https (ESTABLISHED)
...

 

9. Hide host names from lsof command output

When viewing the network and internet files, -n option can be used to hide the host names in the output.

$ lsof -n -i4

Sample Output:

ubuntu@golinux:~$ lsof -n -i4
COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
GeckoMain 3275 ubuntu   90u  IPv4 117174      0t0  TCP 10.0.2.15:37668->34.117.237.239:https (ESTABLISHED)
GeckoMain 3275 ubuntu   91u  IPv4 117189      0t0  TCP 10.0.2.15:46280->13.227.138.71:https (ESTABLISHED)
GeckoMain 3275 ubuntu   95u  IPv4 117982      0t0  TCP 10.0.2.15:42732->52.88.17.115:https (SYN_SENT)
GeckoMain 3275 ubuntu  105u  IPv4 117501      0t0  TCP 10.0.2.15:53968->34.107.221.82:http (ESTABLISHED)
GeckoMain 3275 ubuntu  110u  IPv4 117543      0t0  UDP 127.0.0.1:52285->127.0.0.53:domain 
GeckoMain 3275 ubuntu  121u  IPv4 117983      0t0  TCP 10.0.2.15:42734->52.88.17.115:https (SYN_SENT)
GeckoMain 3275 ubuntu  129u  IPv4 117980      0t0  TCP 10.0.2.15:56810->117.18.237.29:http (ESTABLISHED)
GeckoMain 3275 ubuntu  130u  IPv4 117967      0t0  TCP 10.0.2.15:53100->34.216.162.26:https (ESTABLISHED)
GeckoMain 3275 ubuntu  139u  IPv4 117972      0t0  TCP 10.0.2.15:53102->34.216.162.26:https (ESTABLISHED)

 

10. Display port numbers with lsof command output

-P option displays the port numbers instead of port names for network files. It may make lsof run a little faster.

$ lsof -P -i4

Sample Output:

ubuntu@golinux:~$ lsof -P -i4
COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
GeckoMain 3275 ubuntu   57u  IPv4 188142      0t0  TCP golinux:54098->82.221.107.34.bc.googleusercontent.com:80 (ESTABLISHED)
GeckoMain 3275 ubuntu   93u  IPv4 189498      0t0  TCP golinux:58886->133.247.244.35.bc.googleusercontent.com:443 (ESTABLISHED)
GeckoMain 3275 ubuntu  108u  IPv4 188292      0t0  TCP golinux:50210->ec2-44-229-115-174.us-west-2.compute.amazonaws.com:443 (ESTABLISHED)

 

11. lsof command to list open files by specific process ID

-p option helps to display the opened files by processes whose process IDs are specified.

$ lsof -p pid

Sample Output:

For example, if pid is 3759, it displays only the files opened by process ID 3759.

ubuntu@golinux:~$ lsof -p 3759
COMMAND    PID   USER   FD      TYPE             DEVICE  SIZE/OFF   NODE NAME
WebExtens 3759 ubuntu  cwd       DIR               0,22         0  64943 /proc/3760/fdinfo (deleted)
WebExtens 3759 ubuntu  rtd       DIR               0,22         0  64943 /proc/3760/fdinfo (deleted)
WebExtens 3759 ubuntu  txt       REG                8,5    753048 477719 /usr/lib/firefox/firefox
WebExtens 3759 ubuntu  DEL       REG                0,1               44 /memfd:mozilla-ipc
WebExtens 3759 ubuntu  mem       REG                8,5    829712 477725 /usr/lib/firefox/libfreeblpriv3.so
WebExtens 3759 ubuntu  mem       REG                8,5    325960 477829 /usr/lib/firefox/libsoftokn3.so
WebExtens 3759 ubuntu  mem       REG                8,5    275437 477711 /usr/lib/firefox/browser/features/webcompat@mozilla.org.xpi
WebExtens 3759 ubuntu  mem       REG                8,5    319530 477709 /usr/lib/firefox/browser/features/screenshots@mozilla.org.xpi
WebExtens 3759 ubuntu  mem       REG                8,5     15666 422343 /home/ubuntu/.mozilla/firefox/1d5bir3b.default-release/features/{d226935f-d14d-4e1a-aa04-b84f8de3ca43}/reset-search-defaults@mozilla.com.xpi
...

 

12. Exclude the open files of specific process using lsof command

'^' (negation) also excludes the specified process ID. To exclude the opened files of the specific process, you can use -p option followed by ^PID.

$ lsof -p ^PID

Sample Output:

To exclude the processes with process ID 1321, you can use:

ubuntu@golinux:~$ lsof -p ^1321
COMMAND    PID USER   FD      TYPE DEVICE SIZE/OFF NODE NAME

gsd-datet 1318 1421 dconf\x20           ubuntu    1u     unix 0x0000000000000000      0t0      30512 type=STREAM
gsd-datet 1318 1421 dconf\x20           ubuntu    2u     unix 0x0000000000000000      0t0      30512 type=STREAM
gsd-datet 1318 1421 dconf\x20           ubuntu    3u  a_inode               0,13        0      12388 [eventfd]
gsd-datet 1318 1421 dconf\x20           ubuntu    4u  a_inode               0,13        0      12388 [eventfd]
gsd-datet 1318 1421 dconf\x20           ubuntu    5u     unix 0x0000000000000000      0t0      30850 type=STREAM
gsd-datet 1318 1421 dconf\x20           ubuntu    6u  a_inode               0,13        0      12388 [eventfd]
gsd-datet 1318 1421 dconf\x20           ubuntu    7u  a_inode               0,13        0      12388 [eventfd]
gsd-keybo 1324                          ubuntu  cwd       DIR                8,5     4096     417131 /home/ubuntu
gsd-keybo 1324                          ubuntu  rtd       DIR                8,5     4096          2 /
gsd-keybo 1324                          ubuntu  txt       REG                8,5    39760     407779 /usr/libexec/gsd-keyboard
gsd-keybo 1324                          ubuntu  mem       REG                8,5   182344     407440 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.8...

 

13. List UNIX domain socket files with lsof command

-U option selects the listing of UNIX domain socket files.

$ lsof -U

Sample Output:

ubuntu@golinux:~$ lsof -U
COMMAND    PID   USER   FD   TYPE             DEVICE SIZE/OFF  NODE NAME
systemd    928 ubuntu    1u  unix 0x0000000000000000      0t0 27571 type=STREAM
systemd    928 ubuntu    2u  unix 0x0000000000000000      0t0 27571 type=STREAM
systemd    928 ubuntu    3u  unix 0x0000000000000000      0t0 27598 type=DGRAM
systemd    928 ubuntu   16u  unix 0x0000000000000000      0t0 27605 /run/user/1000/systemd/notify type=DGRAM
systemd    928 ubuntu   17u  unix 0x0000000000000000      0t0 27606 type=DGRAM
systemd    928 ubuntu   18u  unix 0x0000000000000000      0t0 27607 type=DGRAM
systemd    928 ubuntu   19u  unix 0x0000000000000000      0t0 27608 /run/user/1000/systemd/private type=STREAM
systemd    928 ubuntu   20u  unix 0x0000000000000000      0t0 27609 type=STREAM
systemd    928 ubuntu   26u  unix 0x0000000000000000      0t0 27617 /run/user/1000/bus type=STREAM
systemd    928 ubuntu   27u  unix 0x0000000000000000      0t0 27618 /run/user/1000/gnupg/S.dirmngr type=STREAM
...

 

14. lsof command to include PPID column

-R option directs lsof command to list the Parent Process IDentification number in the PPID column.

$ lsof -R

Sample Output:

ubuntu@golinux:~$ lsof -R -u root
COMMAND    PID  TID PPID             USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
systemd      1         0             root  cwd       DIR              253,0      4096          2 /
systemd      1         0             root  rtd       DIR              253,0      4096          2 /
systemd      1         0             root  txt       REG              253,0   1620224     821084 /lib/systemd/systemd
systemd      1         0             root  mem       REG              253,0   1369352     820667 /lib/x86_64-linux-gnu/libm-2.31.so
systemd      1         0             root  mem       REG              253,0    178528     787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd      1         0             root  mem       REG              253,0   1575112     260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd      1         0             root  mem       REG              253,0    137584     820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd      1         0             root  mem       REG              253,0     43312     788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1
systemd      1         0             root  mem       REG              253,0     34872     272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0
...

 

15. lsof command to list UID numbers

You can use -l option to list UID numbers of users instead of their login names.

$ lsof -l

Sample Output:

As you can see the user ID of deepak, 1000 is listed instead of the name.

ubuntu@golinux:~$ lsof -l -u deepak
COMMAND    PID     USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd   2035     1000  cwd       DIR              253,0     4096          2 /
systemd   2035     1000  rtd       DIR              253,0     4096          2 /
systemd   2035     1000  txt       REG              253,0  1620224     821084 /lib/systemd/systemd
systemd   2035     1000  mem       REG              253,0  1369352     820667 /lib/x86_64-linux-gnu/libm-2.31.so
systemd   2035     1000  mem       REG              253,0   178528     787937 /lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd   2035     1000  mem       REG              253,0  1575112     260917 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd   2035     1000  mem       REG              253,0   137584     820733 /lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd   2035     1000  mem       REG              253,0    43312     788557 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1
systemd   2035     1000  mem       REG              253,0    34872     272430 /usr/lib/x86_64-linux-gnu/libargon2.so.0
...

 

16. List terse output with lsof command

-t option tells lsof to produce terse output with process identifiers only and no header.

$ lsof -t

Sample Output:

ubuntu@golinux:~$ lsof -t
901
908
910
916
918
921
924
...

 

17. List all deleted files occupied by any process for a partition

We can use +aL1 <file_system> to list unlinked open files on the specified file system. For example here we we can see, there are multiple unlinked files which are still occupied by PID 31261.

# lsof +aL1 /var
COMMAND   PID     USER    FD   TYPE DEVICE      SIZE NLINK   NODE   NAME
rhn_check 31261    root    8u   REG  253,2   22082560 0 327733 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/primary.xml.gz.sqlite (deleted)
rhn_check 31261    root    9u   REG  253,2      78848  0 327737 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/primary.xml.gz.sqlite (deleted)
rhn_check 31261    root   10u   REG  253,2     144384  0 327741 /var/cache/yum/prod-03-mssb-x86_64-server-5/primary.xml.gz.sqlite (deleted)
rhn_check 31261    root   11u   REG  253,2   54056960  0 327748 /var/cache/yum/prod-03-rhel-x86_64-server-5/primary.xml.gz.sqlite (deleted)
rhn_check 31261    root   12u   REG  253,2    9275392  0 327752 /var/cache/yum/prod-03-rhel-x86_64-server-supplementary-5/primary.xml.gz.sqlite (deleted)
rhn_check 31261    root   13u   REG  253,2     582656  0 327756 /var/cache/yum/prod-03-rhn-tools-rhel-x86_64-server-5-rhel5/primary.xml.gz.sqlite (deleted)
rhn_check 31261    root   14u   REG  253,2   34002944  0 327758 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/filelists.xml.gz.sqlite (deleted)
rhn_check 31261    root   15u   REG  253,2   33857536  0 327760 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/other.xml.gz.sqlite (deleted)
rhn_check 31261    root   16u   REG  253,2      23552  0 327762 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/filelists.xml.gz.sqlite (deleted)
rhn_check 31261    root   17u   REG  253,2       6144  0 327765 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/other.xml.gz.sqlite (deleted)
rhn_check 31261    root   18u   REG  253,2      98304  0 327767 /var/cache/yum/prod-03-mssb-x86_64-server-5/filelists.xml.gz.sqlite (deleted)
rhn_check 31261    root   19u   REG  253,2      68608  0 327769 /var/cache/yum/prod-03-mssb-x86_64-server-5/other.xml.gz.sqlite (deleted)
rhn_check 31261    root   20u   REG  253,2  227818496  0 327772 /var/cache/yum/prod-03-rhel-x86_64-server-5/filelists.xml.gz.sqlite (deleted)
rhn_check 31261    root   21uw  REG  253,2  489109504  0 327774 /var/cache/yum/prod-03-rhel-x86_64-server-5/other.xml.gz.sqlite (deleted)
rhn_check 31261    root   22r   REG  253,2  135095452  0 327773 /var/cache/yum/prod-03-rhel-x86_64-server-5/other.xml.gz (deleted)

 

Conclusion

lsof is a useful command when you want to know the files that are being used by processes in the system. We hope you have learned to use lsof command from this article. If you still have any confusion, please let us know in the comment section.

 

What's Next

20 sar command examples in Linux [Cheat Sheet]

 

Further Reading

man page for lsof command

 

Rohan Timalsina

Rohan Timalsina

He is proficient in a wide range of skills, including Page Builder Plugins such as Elementor, Beaver Builder, Visual Composer, and Divi Builder. His expertise extends to Front End Development with HTML5/CSS3, JavaScript, Bootstrap, and React.js. You can connect with him on his LinkedIn profile.

Can't find what you're searching for? Let us assist you.

Enter your query below, and we'll provide instant results tailored to your needs.

If my articles on GoLinuxCloud has helped you, kindly consider buying me a coffee as a token of appreciation.

Buy GoLinuxCloud a Coffee

For any other feedbacks or questions you can send mail to admin@golinuxcloud.com

Thank You for your support!!

Leave a Comment