cancel
Showing results for 
Search instead for 
Did you mean: 
Chetan_Tiwary_
Community Manager
Community Manager
  • 2,880 Views

lsof - May the "file" be with you !

lsof is a skillful detective, adapt at tracking down the usage of files within your system. This capability allows you to precisely pinpoint which processes are accessing specific files. Such insight proves invaluable in diagnosing access conflicts or performance bottlenecks, ensuring the optimum operation of your system.

***Why is the space still not free even after deleting files ??

***What is causing the system to be slow ??

***Why the application is not responding ??

***What to do when a process is eating up a lot of resources ??

Enter : lsof  ( Full form : Sherlock Holmes.............sorry...... List Open Files  ) !

1. To list all the opened files by a user :   lsof -u <username>

Chetan_Tiwary__0-1701893238575.png

2. To list all the opened files by a process use : lsof -c ssh 

Chetan_Tiwary__1-1701893344408.png

 

3.  Linux may retain deleted files locked by processes, leading to wasted disk space. This is particularly true for large files deliberately deleted to free space without releasing the lock. To list such deleted files in a folder / disk / mount point , use :  lsof <path> | grep deleted

Screenshot from 2023-12-07 01-07-17.png

 

4. To list opened files by a user for a process using the AND operator ( -a )  : without -a it will work as a OR operator 

Screenshot from 2023-12-07 01-09-56.png

5. To list opened files by a network connection regardless of conection type :

Chetan_Tiwary__2-1701894052895.png

 

6. To display a list of all files that are currently memory-mapped by running processes :

Chetan_Tiwary__3-1701894205228.png

7. To list opened files by a pid :

Chetan_Tiwary__4-1701894371980.png

 

8. If you want help for lsof command on the command line : use the man page or use this :

Chetan_Tiwary__5-1701894434143.png

9.  A great use of lsof can be to list the opened files by indirectly getting the pid through process name  or to kill all processes by a specific user :

 

#lsof -p $(pidof ssh)

#kill -9 'lsof -t -u student'  ( CAUTION - this is a brute-force approach to dealing with temporary files may be problematic )

 

Refer : https://linux.die.net/man/8/lsof  for details of the command fields and option explanations and the terminolgies used

Tags (3)
1 Reply
Wasim_Raja
Moderator
Moderator
  • 2,840 Views

Good one!!

0 Kudos
Join the discussion
You must log in to join this conversation.