Linux: Show Opened Files, lsof

By Xah Lee. Date: . Last updated: .

You can use the command lsof to list all files opened by processes.

In unix/linux, “everything” is a file. Devices (such as all USB device) are files, network sockets are files, directory is a file.

Here's some of the commonly used options.

lsof -h
Display a short help documentation.
lsof fpath
Show all that has opened file at fpath
lsof -i
List files associated with internet (For example, browser process)
lsof -u userName
Show all with login/uid userName
lsof -p pid
By pid. 123,^456
lsof +d dir
By dir path dir
lsof +D dir
By dir path dir, also show all dir's children
lsof -c cmd
Show files opened by command whose name starts with cmd
linux lsof 2017 04 18
lsof showing first few files opened by firefox

FD means “file descriptor”. Common FD code are:

cwd
Current working directory
ltx
Shared library text (code and data)
m86
DOS Merge mapped file
mem
Memory-mapped file
mmap
Memory-mapped device
pd
Parent directory
rtd
Root directory
txt
Program text (code and data)
number
File descriptor. 0 is stdin, 1 is stdout, 2 is stderr. A letter {r,w,u} after it means mode. “u” = read and write. “r” = read. “w” = write.

see man lsof for complete list and description.

TYPE → is the file type. Common types are:

REG
Regular file
LINK
Symbolic link file
DIR
Directory
BLK
Block special file (device file)
CHR
Character special file (device file)
FIFO
FIFO special file
PIPE
Pipes
PMEM
/proc memory image file
IPv4
IPv4 socket
IPv6
Open IPv6 network file - even if its address is IPv4, mapped in an IPv6 address
inet
Internet domain socket
sock
Socket of unknown domain
unix
UNIX domain socket

Linux Shell Basics

Sys Admin

Bash/Terminal

Linux Desktop