lsof Cheatsheet
Quick reference for finding open files, processes, ports, and deleted files with lsof in Linux
The `lsof` command lists open files and the processes using them in Linux. This cheatsheet covers common filters for ports, users, PIDs, directories, deleted files, and practical troubleshooting patterns.
Basic Syntax
Core lsof command forms.
| Command | Description |
|---|---|
lsof | List open files visible to the current user |
sudo lsof | List open files system-wide |
lsof /path/to/file | Show which process has a file open |
lsof -p 1234 | Show files opened by one PID |
lsof -u username | Show files opened by one user |
Port and Network Checks
Find listeners and active network connections.
| Command | Description |
|---|---|
sudo lsof -nP -iTCP:80 -sTCP:LISTEN | Find what is listening on TCP port 80 |
sudo lsof -i | List all network connections |
sudo lsof -i TCP | List TCP connections |
sudo lsof -i UDP | List UDP connections |
sudo lsof -nP -iTCP:443 -sTCP:LISTEN | Filter to listeners on TCP port 443 |
Process and User Filters
Filter open files by process, command name, or user.
| Command | Description |
|---|---|
sudo lsof -p 1234 | Files opened by PID 1234 |
sudo lsof -p ^1234 | Exclude PID 1234 |
sudo lsof -c nginx | Files opened by commands starting with nginx |
lsof -u john | Files opened by user john |
sudo lsof -u ^john | Exclude files opened by user john |
Files and Directories
Check who is using a file or directory tree.
| Command | Description |
|---|---|
lsof /var/log/nginx/access.log | Show processes using one file |
sudo lsof +d /var/log | Show open files in one directory level |
sudo lsof +D /var/log | Show open files in a directory recursively |
sudo lsof +D /mountpoint | Find what is blocking an unmount |
sudo lsof /dev/sda | Check processes using a device file |
Deleted Files and Disk Space
Find deleted files that still consume disk space.
| Command | Description |
|---|---|
sudo lsof +L1 | List deleted files still held open |
sudo lsof +L1 /var | Limit deleted-file search to one path |
sudo lsof -a +L1 -u nginx | Deleted files still open for one user |
sudo lsof +L1 | sort -k7 -n | Sort deleted-file output by size/off column |
sudo lsof +L1 | grep deleted | Quick filter for deleted entries |
Scripting and Combined Filters
Use lsof in scripts and tighter searches.
| Command | Description |
|---|---|
sudo lsof -t -iTCP:8080 -sTCP:LISTEN | Output only the PID listening on port 8080 |
sudo lsof -a -u john -i TCP | Show only TCP connections owned by john |
sudo lsof -a -p 1234 -d cwd | Show only the current working directory for one PID |
sudo lsof -Fn -p 1234 | Machine-readable output for scripts |
kill $(sudo lsof -t -iTCP:8080 -sTCP:LISTEN) | Stop the process listening on port 8080 |
Troubleshooting
Quick checks for common lsof usage issues.
| Issue | Check |
|---|---|
| Output looks incomplete | Run with sudo to see files opened by other users’ processes |
| Port lookup shows service names instead of numbers | Add -nP for numeric addresses and ports |
| Need listeners only, not all connections | Add -sTCP:LISTEN with -iTCP:PORT |
| Recursive directory search is slow | Prefer +d for top-level only, or narrow the path |
| Disk space is still not freed after delete | Use lsof +L1 and restart the process holding the file |
Related Guides
Use these guides for the full walkthroughs.
| Guide | Description |
|---|---|
lsof Command in Linux | Full lsof guide with examples |
ss Command in Linux | Inspect sockets and listening services |
| How to Check Listening Ports in Linux | Compare ss, netstat, and lsof |
| Find Large Files in Linux | Track disk usage and deleted files |
ps Command in Linux | Inspect processes and related details |