lsof Command Linux: List Open Files Guide

Updated 6 November 2026 · Standard formula, shown below

The lsof command in Linux lists open files, including regular files, directories, sockets, pipes, and devices. You run it with options and a name (like a process, user, or file path) to see which processes hold which files open, and the output shows the process ID, user, file descriptor, and file path. It is the standard tool for answering “who is using this file?” or “what has this process open?” on Unix-like systems.

Why “Everything is a File” Matters

Linux treats almost every resource as a file: regular data files, directories, block devices, character devices, sockets, pipes, and even network connections. When a process opens any of these, the kernel creates a file descriptor (a number) that the process uses to read or write. lsof reads the kernel’s file table and presents it in a readable format. That is why lsof can show you not just text files but also TCP connections, Unix domain sockets, and mounted devices.

Without lsof, you would have to guess which process is holding a file. For example, you cannot unmount a USB drive if some process still has a file open on it. lsof tells you exactly which PID is blocking the unmount.

Basic Syntax and Output Columns

The simplest form is lsof with no arguments, which lists every open file on the system — usually thousands of lines. You almost always narrow it down. The output has these columns:

COMMAND — the name of the process (e.g., bash, nginx)
PID — process ID
TUSER — user who owns the process
FD — file descriptor number, or cwd (current working directory), txt (executable text), mem (memory-mapped file), rtd (root directory)
TYPE — file type: REG (regular file), DIR (directory), CHR (character device), BLK (block device), IPv4/IPv6 (network socket), unix (Unix socket), FIFO (pipe)
DEVICE — device number (e.g., 8,1)
SIZE/OFF — file size or offset
NAME — the file path, or socket details like TCP host:port->remote:port

Example: lsof -p 1234 shows all files opened by process 1234. The first line is the process’s current working directory, then the executable, then any libraries or data files.

Common Options and Real Examples

Here are the options users type most often:

lsof /path/to/file — list processes using that specific file
lsof +D /directory — list files opened under a directory (recursive; can be slow on large trees)
lsof -u username — all files opened by a user (add ^ before the name to exclude, e.g., -u ^root)
lsof -c nginx — all files opened by processes whose command starts with nginx
lsof -i — all network connections (IPv4 and IPv6)
lsof -i :8080 — connections on port 8080
lsof -iTCP -sTCP:LISTEN — only listening TCP sockets
lsof -p PID — files for a specific process ID
lsof +L1 — files that are unlinked (deleted but still open)

Combine options: lsof -u alice -i shows Alice’s network connections. lsof -c ssh -iTCP shows SSH processes’ TCP connections.

How lsof Gets Its Data

lsof does not scan the filesystem. It reads kernel data structures through the /proc filesystem (on Linux) and the sysctl interface (on BSD/macOS). Specifically, it looks at /proc/[pid]/fd (symlinks to open files), /proc/[pid]/maps (memory-mapped files), and /proc/net/tcp for sockets. Because it reads the kernel’s live state, the output is always current — there is no cache. Running lsof requires permission to read other users’ process information; a normal user sees only their own processes unless they run with sudo. Some files (like kernel threads) may show as permission denied without root.

Common Problems and Solutions

The most frequent issue is “device or resource busy” when trying to unmount a drive or delete a file. The fix: run lsof /mnt/usb to find the PID, then close the program or kill the process. Another common problem is “no output” — this usually means you lack permission, or the file is not actually open. If you are looking for a deleted file, use lsof +L1 to show open files with a link count of zero; these are files that were deleted but still held open by a process, which can fill up disk space. To see the size of such a file, look at the SIZE/OFF column.

Another pitfall: lsof -i shows all network connections, but on a busy server the output can be huge. Narrow it with -i :port or -iTCP@host. Also, lsof +D can be slow on directories with many files because it walks the entire tree. Use lsof /directory (non-recursive) first to see if that is enough.

Alternatives and When to Use Them

On Linux, fuser is a simpler tool: fuser -v /path shows which PIDs are using a file, and fuser -k /path kills them. lsof gives more detail but fuser is faster for a quick check. The /proc filesystem itself is an alternative: ls -l /proc/[pid]/fd shows the file descriptors, but it is not as readable. For network sockets specifically, ss (socket statistics) is often more current than lsof -i and is the recommended tool for network troubleshooting. lsof is still better when you need to map a socket back to a process and see all its other open files at once.

There is also lslocks (from util-linux) to list file locks, which is related but not the same. If you only need to know which process holds a lock, lslocks may be clearer.

Safety and Performance Notes

Running lsof is read-only and safe; it does not change any state. However, on a system with many processes, running lsof without filters can be slow and produce tens of thousands of lines. Always narrow the scope with a path, user, process name, or port. When you see a file you want to free, do not blindly kill a process — first check what the process is (with ps -p PID -o comm=) and whether closing it gracefully is possible. Killing a system daemon like systemd or sshd can disrupt services. If a deleted file is still open and consuming disk space, you can sometimes truncate it with : > /proc/[pid]/fd/[fd] (as root) to free space without killing the process, but this is an advanced operation.

Frequently Asked Questions

How do I list all open files by a specific user?
Run lsof -u username. Replace username with the actual login name. To exclude a user, prefix with ^: lsof -u ^root shows everything not owned by root.

How do I find which process is using a port?
Run lsof -i :8080 (replace 8080 with your port). The output shows the PID and command. Add -sTCP:LISTEN to see only the listening process, not established connections.

Why does lsof show “permission denied” for some files?
You do not have permission to read that process’s file descriptors. Use sudo lsof to see all processes. Without root, you can still see your own processes.

What does “deleted” mean in the NAME column?
The file was unlinked (deleted) but a process still holds it open. The space is not freed until the process closes the file or exits. Use lsof +L1 to find these.

How do I list open files for a specific process ID?
Run lsof -p 1234 (replace 1234 with the PID). You can also combine with -i to see only network connections for that process.

Is lsof installed by default on Linux?
It is installed on most distributions, but not all minimal containers. If not, install it with your package manager, e.g., apt install lsof (Debian/Ubuntu) or dnf install lsof (Fedora/RHEL).

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.