lsof Cheatsheet
Basic Syntax
Core lsof command forms.
| Command | Description |
|---|---|
lsof |
List open files visible to the current user |
sudo lsof |
List open files system-wide |
lsof /path/to/file |
Show which process has a file open |
lsof -p 1234 |
Show files opened by one PID |
lsof -u username |
Show files opened by one user |
Port and Network Checks
Find listeners and active network connections.
| Command | Description |
|---|---|
sudo lsof -nP -iTCP:80 -sTCP:LISTEN |
Find what is listening on TCP port 80 |
sudo lsof -i |
List all network connections |
sudo lsof -i TCP |
List TCP connections |
sudo lsof -i UDP |
List UDP connections |
sudo lsof -nP -iTCP:443 -sTCP:LISTEN |
Filter to listeners on TCP port 443 |
Process and User Filters
Filter open files by process, command name, or user.
| Command | Description |
|---|---|
sudo lsof -p 1234 |
Files opened by PID 1234 |
sudo lsof -p ^1234 |
Exclude PID 1234 |
sudo lsof -c nginx |
Files opened by commands starting with nginx |
lsof -u john |
Files opened by user john |
sudo lsof -u ^john |
Exclude files opened by user john |
Files and Directories
Check who is using a file or directory tree.
| Command | Description |
|---|---|
lsof /var/log/nginx/access.log |
Show processes using one file |
sudo lsof +d /var/log |
Show open files in one directory level |
sudo lsof +D /var/log |
Show open files in a directory recursively |
sudo lsof +D /mountpoint |
Find what is blocking an unmount |
sudo lsof /dev/sda |
Check processes using a device file |
Deleted Files and Disk Space
Find deleted files that still consume disk space.
| Command | Description |
|---|---|
sudo lsof +L1 |
List deleted files still held open |
sudo lsof +L1 /var |
Limit deleted-file search to one path |
sudo lsof -a +L1 -u nginx |
Deleted files still open for one user |
sudo lsof +L1 | sort -k7 -n |
Sort deleted-file output by size/off column |
sudo lsof +L1 | grep deleted |
Quick filter for deleted entries |
Scripting and Combined Filters
Use lsof in scripts and tighter searches.
| Command | Description |
|---|---|
sudo lsof -t -iTCP:8080 -sTCP:LISTEN |
Output only the PID listening on port 8080 |
sudo lsof -a -u john -i TCP |
Show only TCP connections owned by john |
sudo lsof -a -p 1234 -d cwd |
Show only the current working directory for one PID |
sudo lsof -Fn -p 1234 |
Machine-readable output for scripts |
kill $(sudo lsof -t -iTCP:8080 -sTCP:LISTEN) |
Stop the process listening on port 8080 |
Troubleshooting
Quick checks for common lsof usage issues.
| Issue | Check |
|---|---|
| Output looks incomplete | Run with sudo to see files opened by other users’ processes |
| Port lookup shows service names instead of numbers | Add -nP for numeric addresses and ports |
| Need listeners only, not all connections | Add -sTCP:LISTEN with -iTCP:PORT |
| Recursive directory search is slow | Prefer +d for top-level only, or narrow the path |
| Disk space is still not freed after delete | Use lsof +L1 and restart the process holding the file |
Related Guides
Use these guides for the full walkthroughs.
| Guide | Description |
|---|---|
lsof Command in Linux
|
Full lsof guide with examples |
ss Command in Linux
|
Inspect sockets and listening services |
| How to Check Listening Ports in Linux | Compare ss, netstat, and lsof |
| Find Large Files in Linux | Track disk usage and deleted files |
ps Command in Linux
|
Inspect processes and related details |
AI Assistant
