lsof

#### lsof ####

lsof - list open files

In the absence of any options, lsof lists all open files belonging to all active processes.

$ sudo lsof -c apache2 :

[  -c c     selects the listing of files for processes executing the command that begins with the characters of c.  Multiple commands may be specified, using multiple -c options.  They are joined in a  sin‐
                gle ORed set before participating in AND option selection. ]
               
               
$ lsof +D /etc :

 -D D     directs lsof's use of the device cache file.  The use of this option is sometimes restricted.  See the DEVICE CACHE FILE section and the sections that follow it  for  more  information  on  this
                option.



 +|-L [l] enables (`+') or disables (`-') the listing of file link counts, where they are available - e.g., they aren't available for sockets, or most FIFOs and pipes.

                When +L is specified without a following number, all link counts will be listed.  When -L is specified (the default), no link counts will be listed.

                When +L is followed by a number, only files having a link count less than that number will be listed.  (No number may follow -L.)  A specification of the form ``+L1'' will select open files that
                have been unlinked.  A specification of the form ``+aL1 <file_system>'' will select unlinked open files on the specified file system.



 -N       selects the listing of NFS files.


  -p s     excludes or selects the listing of files for the processes whose optional process IDentification (PID) numbers are in the comma-separated set s - e.g., ``123'' or ``123,^456''.  (There should be
                no spaces in the set.)

                PID numbers that begin with `^' (negation) represent exclusions.

                Multiple  process  ID  numbers  are  joined in a single ORed set before participating in AND option selection.  However, PID exclusions are applied without ORing or ANDing and take effect before
                other selection criteria are applied.




EXAMPLES
       For a more extensive set of examples, documented more fully, see the 00QUICKSTART file of the lsof di
stribution.

       To list all open files, use:

              lsof

       To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:

              lsof -i -U

       To list all open IPv4 network files in use by the process whose PID is 1234, use:

              lsof -i 4 -a -p 1234

       Presuming the UNIX dialect supports IPv6, to list only open IPv6 network files, use:

              lsof -i 6

       To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu, use:

              lsof -i @wonderland.cc.purdue.edu:513-515

       To list all files using any protocol on any port of mace.cc.purdue.edu (cc.purdue.edu is the default
domain), use:

              lsof -i @mace

       To list all open files for login name ``abe'', or user ID 1234, or process 456, or process 123, or process 789, use:

              lsof -p 456,123,789 -u 1234,abe

       To list all open files on device /dev/hd4, use:

              lsof /dev/hd4

       To find the process that has /u/abe/foo open, use:

              lsof /u/abe/foo

       To send a SIGHUP to the processes that have /u/abe/bar open, use:

              kill -HUP `lsof -t /u/abe/bar`

       To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

              lsof /dev/log


To find processes with open files on the NFS file system named /nfs/mount/point whose server is inacc
essible, and presuming your mount table supplies the device number for /nfs/mount/point, use:

              lsof -b /nfs/mount/point

       To do the preceding search with warning messages suppressed, use:

              lsof -bw /nfs/mount/point

       To ignore the device cache file, use:

              lsof -Di

       To obtain PID and command name field output for each process, file descriptor, file device number, and file inode number for each file of each process, use:

              lsof -FpcfDi

       To list the files at descriptors 1 and 3 of every process running the lsof command for login ID ``abe'' every 10 seconds, use:

              lsof -c lsof -a -d 1 -d 3 -u abe -r10

       To list the current working directory of processes running a command that is exactly four characters long and has an 'o' or 'O' in character three, use this regular expression form of the -c c option:

              lsof -c /^..o.$/i -a -d cwd

       To find an IP version 4 socket file by its associated numeric dot-form address, use:

              lsof -i@128.210.15.17

       To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by its associated numeric colon-form address, use:

              lsof -i@[0:1:2:3:4:5:6:7]

       To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by an associated numeric colon-form address that has a run of zeroes in it - e.g., the loop-back address - use:

              lsof -i@[::1]

       To obtain a repeat mode marker line that contains the current time, use:

              lsof -rm====%T====

       To add spaces to the previous marker line, use:

              lsof -r "m==== %T ===="