Linux: Show Open Files, 「lsof」 Tutorial

,

You can use the command lsof to list all files opened by processes.

In unix/linux, “everything” is a file. Devices (such as all USB device) are files, network sockets are files, directory is a file, ….

Here's some of the commonly used options.

Here's sample lsof showing first few files opened by firefox

◆ lsof -c firefox | head
COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF     NODE NAME
firefox 5815  xah  cwd    DIR                8,5     4096  4329915 /home/xah
firefox 5815  xah  rtd    DIR                8,5     4096        2 /
firefox 5815  xah  txt    REG                8,5   100896  3290494 /usr/lib/firefox/firefox
firefox 5815  xah  mem    REG                8,5   502416  3284315 /usr/lib/x86_64-linux-gnu/liborc-0.4.so.0.16.0
firefox 5815  xah  mem    REG                8,5   113752  3284202 /usr/lib/x86_64-linux-gnu/libgstvideo-0.10.so.0.25.0
firefox 5815  xah  mem    REG                8,5   340256  3284166 /usr/lib/x86_64-linux-gnu/libgstbase-0.10.so.0.30.0
firefox 5815  xah  mem    REG                8,5    48208  3284162 /usr/lib/x86_64-linux-gnu/libgstapp-0.10.so.0.25.0
firefox 5815  xah  mem    REG                8,5   939072  3284190 /usr/lib/x86_64-linux-gnu/libgstreamer-0.10.so.0.30.0
firefox 5815  xah  mem    REG                8,5  6234746  4198129 /usr/share/fonts/truetype/takao-gothic/TakaoPGothic.ttf

FD → means “file descriptor”. Common FD code are:

see man lsof for complete list and description.

TYPE → is the file type. Common types are:

blog comments powered by Disqus