List all open files with lsof


The lsof command stands for “list open files”. It can show all open files as well as sockets, memory mapped libraries, directories, pipes, and network sockets. It is an incredibly powerful tool which you can use to gather detailed information about what is happening on your system.

If you run lsof as a normal user you will be limited to only the the processes owned by that user. To get system wide results you must run the command as root or use sudo.

Running the command by itself will show information for all active process on the system.

As you can see in the previous output each open file is associated with its program and PID and has many attributes such as type, size, file descriptor, device, and inode number.

You can narrow the results down to an individual process.

You can get results for every process that is owned by a specific user.

This will give you detailed information about all network socket connections.

You can narrow the results down to only TCP connections.

You can get information on a specific port.

You can get information about all instances of a specific program

This will show all files that are open within the ‘/tmp’ directory.

To get even more detailed output you can pipe these results to grep or use the ‘-a‘ option which combines any number of options.

For example you can view all network socket connections that are owned by the user ryan.