LSOF Command Usage on RHEL 7 or CentOS 7

1. LSOF Usage Guide on RHEL 7
i | P a g e
Table of Contents
Overview.......................................................................................................................................................1
Applies To......................................................................................................................................................1
Pre-Requisites ...............................................................................................................................................1
Install Package...............................................................................................................................................1
Validate Package Installation........................................................................................................................1
File Descriptor Table .................................................................................................................................2
Type Descriptor Table...............................................................................................................................2
List of Opened Files – User............................................................................................................................3
List of Opened Files – Exclude User ..............................................................................................................3
List of Opened Files – Directory....................................................................................................................4
List of Open Files – By Process Name Starting With.....................................................................................4
List of Open Files – By PID.............................................................................................................................5
List Processes – By Specific File.....................................................................................................................5
List all Network Connections ........................................................................................................................6
List Network Connections – Only IPv4..........................................................................................................6
List Network Connections – Only IPv6..........................................................................................................6
List Network Connections – TCP Port Range ................................................................................................7
List Network Connections – UDP Port Range ...............................................................................................7
Find Processes Running – Specific Port.........................................................................................................7
List all network files in use by a specific process..........................................................................................7
List of Files in Repeat Mode..........................................................................................................................8
List of Files in Repeat Mode..........................................................................................................................8
List all NFS files..............................................................................................................................................9
Kill All process of a particular user................................................................................................................9

2. LSOF Usage Guide on RHEL 7
1 | P a g e
Overview
The purpose of this document is guide you the usage of “lsof” command. LSOF command is utilized to
know the “LiSt of Open Files” by processes. As we are aware Linux / Unix considers everything as files such
as (pipes, sockets, devices, etc.).
This command is also useful when you want to unmount filesystem and but you are unable to unmount
filesystem or process is running is memory. It is also useful wherein a file is deleted and file is resident in
memory. lsof command will help us to find out files that are currently in use and its current state of such
files.
Applies To
Tested on RHEL 7, CentOS 7.
Pre-Requisites
 lsof package is installed
Install Package
LSOF package is installed by default in when you install operating system, in order to install the package
if the package is not installed run the command;
yum install -y lsof
Validate Package Installation
To verify the package installation status, run the command;
rpm -qa | grep lsof

3. LSOF Usage Guide on RHEL 7
2 | P a g e
First you need to understand the output of lsof command, below will give you a brief insight to different
sections.
FD and Types are the that we will focus upon, reset of the fields are self-explanatory.
File Descriptor Table
FD stands for File Descriptor and it has different values are listed when you the command. A few of them
are listed below.
File Descriptor Purpose
cwd current working directory
rtd root directory
pd parent directory
txt program text (code and data)
mem memory-mapped file
mmap Memory mapped device
number character The character after the number i.e ‘1u’, represents the
mode in which the file is opened.
r for read, w for write, u for read and write.
Type Descriptor Table
Specifies the type of the file. Some of the values of TYPEs are,
Type Descriptor Type of File
REG Regular File
DIR Directory
FIFO First In First Out
CHR Character special file

4. LSOF Usage Guide on RHEL 7
3 | P a g e
List of Opened Files – User
To list the files opened by a user, run the command;
lsof -u chrony
Note: To list of files that are open for multiple users run the command lsof -u mysql -u postfix.
List of Opened Files – Exclude User
To list of open files excluding a user(s), execute with option “-u” and “^” along with the user, run the
command;
lsof -u^root
Note: To exclude results of additional users, run the command lsof -u ^mysql -u ^chrony -u ^dbus.

5. LSOF Usage Guide on RHEL 7
4 | P a g e
List of Opened Files – Directory
To list the files that are opened in a specific directory, run the command;
lsof +D /var/log/
List of Open Files – By Process Name Starting With
List the files that are open by process name(s) starting with, run the command;
lsof -c mysql
Note: To list of files that are open for multiple process names run the command lsof -c mysql -c systemd.

6. LSOF Usage Guide on RHEL 7
5 | P a g e
List of Open Files – By PID
To list files that are open by process id, run the command;
ps -ef | grep [m]ysqld_safe
lsof -p 1164
List Processes – By Specific File
To list the processes associated with a specific file, run the command;
lsof /var/log/Xorg.0.log

7. LSOF Usage Guide on RHEL 7
6 | P a g e
List all Network Connections
List all the network connections listening and established, run the command;
lsof -i
List Network Connections – Only IPv4
List all IPv4 network connections listening and established, run the command;
lsof -i 4
List Network Connections – Only IPv6
List all IPv6 network connections listening and established, run the command;
lsof -i 6

8. LSOF Usage Guide on RHEL 7
7 | P a g e
List Network Connections – TCP Port Range
List all the network connections listening and established for TCP port range, Run the command;
lsof -i TCP:1-1024
List Network Connections – UDP Port Range
List all the network connections listening and established for UDP port range, run the command;
lsof -i UDP:1-1024
Find Processes Running – Specific Port
To list the process running on a specific port, run the command;
lsof -i :22
List all network files in use by a specific process
To list all the network files which is being used by a process; run the command
lsof -i -a -p 8132 or lsof -i -a -c ssh

9. LSOF Usage Guide on RHEL 7
8 | P a g e
List of Files in Repeat Mode
To list the files that are opened in repeat mode (loop until no files are open) “+” is prefixed before
command “repeat option r” and refresh the output every 2 seconds, run the command;
lsof -i -a -c ssh +r2
Note: Each cycle output is separated by “=======”
List of Files in Repeat Mode
To list the files that are opened in repeat mode (loop until interrupt “ctrl +c”) “-” is prefixed before
command “repeat option r” and refresh the output every 5 seconds, run the command;
lsof -i -a -c ssh -r5
Note: Each cycle output is separated by “=======”

10. LSOF Usage Guide on RHEL 7
9 | P a g e
List all NFS files
To list Network file system files in use, for a user. Run the command;
lsof -N -u root -a
Note: In this case there is NFS is not utilized.
Kill All Process of a Particular User
To list and kill all the process of a particular user; “-t” option will list only the process id of the user, run
the command;
lsof -t -u postfix
kill -9 `lsof -t -u postfix`