Lsof

Internal

• Linux

Overview

lsof lists information about files opened by processes. lsof provides information about:

• regular files
• directories
• block special files
• character special files
• executing text references
• libraries
• streams
• network files (Internet socket, NFS file or UNIX domain socket)

In absence of any options, lsof lists all open files by all processes.

To list open files by a specific process, use the process' PID as follows:

lsof -p <pid>

The output is similar to:

COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
java    10016 vagrant  cwd    DIR              252,2     4096 2621584 /home/test
java    10016 vagrant  rtd    DIR              252,0     4096       2 /
java    10016 vagrant  txt    REG              252,2     7734 2885001 /opt/java/x64/jre1.8.0_51/bin/java
java    10016 vagrant  mem    REG              252,0   161704 1310723 /lib64/ld-2.12.so
[...]
java    10016 vagrant    0r   CHR                1,3      0t0      26 /dev/null
java    10016 vagrant    1u   CHR              136,0      0t0       3 /dev/pts/0 (deleted)
java    10016 vagrant    2u   CHR              136,0      0t0       3 /dev/pts/0 (deleted)
java    10016 vagrant    3w   REG              252,2    48759 2753619 /home/test/gc.log.0.current
java    10016 vagrant    4r   REG              252,2 65944582 2884909 /opt/java/x64/jre1.8.0_51/lib/rt.jar
java    10016 vagrant    5u  IPv4              39331      0t0     TCP *:msgsrvr (LISTEN)
[...]

File Descriptor Information

The command provides file descriptor information by default, as the fourth field "FD". The FD column contents constitutes a single field for parsing in post-processing scripts. It can be interpreted as following:

      FD         is the File Descriptor number of the file or:

Special entries are marked as such:

• "cwd" - current working directory
• "err" - FD information error (see NAME column)
• "jld" - jail directory (FreeBSD)
• "ltx" - shared library text (code and data)
• "Mxx" - hex memory-mapped type number xx
• "m86" - DOS Merge mapped file
• "mem" - memory-mapped file
• "mmap"- memory-mapped device

                      pd   parent directory;
                      rtd  root directory;
                      tr   kernel trace file (OpenBSD);
                      txt  program text (code and data);
                      v86  VP/ix mapped file;

                 FD is followed by one of these characters, describing the mode under which the file is open:

                      r for read access;
                      w for write access;
                      u for read and write access;
                      space if mode unknown and no lock
                           character follows;
                      ‘-’ if mode unknown and lock
                           character follows.

                 The mode character is followed by one of these lock characters, describing the type of lock applied to the file:

                      N for a Solaris NFS lock of unknown type;
                      r for read lock on part of the file;
                      R for a read lock on the entire file;
                      w for a write lock on part of the file;
                      W for a write lock on the entire file;
                      u for a read and write lock of any length;
                      U for a lock of unknown type;
                      x for an SCO OpenServer Xenix lock on part      of the file;
                      X for an SCO OpenServer Xenix lock on the      entire file;
                      space if there is no lock.

                 See the LOCKS section for more information on the lock information character.