man lsof Command

Man page for apt-get lsof Command

Man Page for lsof in Linux

This tutorial shows the man page for man lsof in linux.

Open terminal with 'su' access and type the command as shown below:
man lsof

Result of the Command Execution shown below:

LSOF(8)                                                                                                                                                      LSOF(8)



NAME
       lsof   list open files

SYNOPSIS
       lsof  [  ?abChlnNOPRtUvVX ] [  A A ] [  c c ] [ +c c ] [ +| d d ] [ +| D D ] [ +| f [cfgGn] ] [  F [f] ] [  g [s] ] [  i [i] ] [  k k ] [ +| L [l] ] [ +| m m
       ] [ +| M ] [  o [o] ] [  p s ] [ +| r [t[m<fmt>]] ] [  s [p:s] ] [  S [t] ] [  T [t] ] [  u s ] [ +| w ] [  x [fl] ] [  z [z] ] [  Z [Z] ] [    ] [names]

DESCRIPTION
       Lsof revision 4.81 lists on its standard output file information about files opened by processes for the following UNIX dialects:

            AIX 5.3
            FreeBSD 4.9 for x86 based systems
            FreeBSD 7.0 and 8.0 for AMD64 based systems
            Linux 2.1.72 and above for x86 based systems
            Solaris 9 and 10

       (See the DISTRIBUTION section of this manual page for information on how to obtain the latest lsof revision.)

       An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or  a  net Äê
       work file (Internet socket, NFS file or UNIX domain socket.)  A specific file or all the files in a file system may be selected by path.

       Instead of a formatted display, lsof will produce output that can be parsed by other programs.  See the  F, option description, and the OUTPUT FOR OTHER PRO Äê
       GRAMS section for more information.

       In addition to producing a single output list, lsof will run in repeat mode.  In repeat mode it will produce output, delay, then repeat the output  operation
       until stopped with an interrupt or quit signal.  See the +| r [t[m<fmt>]] option description for more information.

OPTIONS
       In the absence of any options, lsof lists all open files belonging to all active processes.

       If  any list request option is specified, other list requests must be specifically requested   e.g., if  U is specified for the listing of UNIX socket files,
       NFS files won't be listed unless  N is also specified; or if a user list is specified with the  u option, UNIX domain socket files, belonging to users not in
       the list, won't be listed unless the  U option is also specified.

       Normally  list  options  that are specifically stated are ORed   i.e., specifying the  i option without an address and the  ufoo option produces a listing of
       all network files OR files belonging to processes owned by user ``foo''.  The exceptions are:

       1)                                                                      the `^' (negated) login name or user ID (UID), specified with the  u option;

       2)                                                                      the `^' (negated) process ID (PID), specified with the  p option;

       3)                                                                      the `^' (negated) process group ID (PGID), specified with the  g option;

       4)                                                                      the `^' (negated) command, specified with the  c option;

       5)                                                                      the ('^') negated TCP or UDP protocol  state  names,  specified  with  the   s  [p:s]
                                                                               option.

       Since they represent exclusions, they are applied without ORing or ANDing and take effect before any other selection criteria are applied.

       The   a option may be used to AND the selections.  For example, specifying  a,  U, and  ufoo produces a listing of only UNIX socket files that belong to pro Äê
       cesses owned by user ``foo''.

       Caution: the  a option causes all list selection options to be ANDed; it can't be used to cause ANDing of selected pairs of selection options by  placing  it
       between them, even though its placement there is acceptable.  Wherever  a is placed, it causes the ANDing of all selection options.

       Items  of the same selection set   command names, file descriptors, network addresses, process identifiers, user identifiers, zone names, security contexts  
       are joined in a single ORed set and applied before the result participates in  ANDing.   Thus,  for  example,  specifying   i@aaa.bbb,   i@ccc.ddd,   a,  and
        ufff,ggg will select the listing of files that belong to either login ``fff'' OR ``ggg'' AND have network connections to either host aaa.bbb OR ccc.ddd.

       Options  may  be  grouped  together following a single prefix    e.g., the option set `` a  b  C'' may be stated as  abC.  However, since values are optional
       following +| f,  F,  g,  i, +| L,  o, +| r,  s,  S,  T,  x and  z.  when you have no values for them be careful that the following character isn't ambiguous.
       For  example,   Fn  might represent the  F and  n options, or it might represent the n field identifier character following the  F option.  When ambiguity is
       possible, start a new option with a ` ' character   e.g., `` F  n''.  If the next option is a file name, follow the possibly ambiguous option with  ``  ''   
       e.g., `` F    name''.

       Either  the  `+'  or  the  ` ' prefix may be applied to a group of options.  Options that don't take on separate meanings for each prefix   e.g.,  i   may be
       grouped under either prefix.  Thus, for example, ``+M  i'' may be stated as ``+Mi'' and the group means the same as the separate options.  Be careful of pre Äê
       fix  grouping  when one or more options in the group does take on separate meanings under different prefixes   e.g., +| M; `` iM'' is not the same request as
       `` i +M''.  When in doubt, use separate options with appropriate prefixes.

        ?  h    These two equivalent options select a usage (help) output list.  Lsof displays a shortened form of this output when  it  detects  an  error  in  the
                options supplied to it, after it has displayed messages explaining each error.  (Escape the `?' character as your shell requires.)

        a       This option causes list selection options to be ANDed, as described above.

        A A     This option is available on systems configured for AFS whose AFS kernel code is implemented via dynamic modules.  It allows the lsof user to specify
                A as an alternate name list file where the kernel addresses of the dynamic modules might be found.  See the lsof FAQ  (The  FAQ  section  gives  its
                location.)  for more information about dynamic modules, their symbols, and how they affect lsof.

        b       This option causes lsof to avoid kernel functions that might block   lstat(2), readlink(2), and stat(2).

                See the BLOCKS AND TIMEOUTS and AVOIDING KERNEL BLOCKS sections for information on using this option.

        c c     This  option selects the listing of files for processes executing the command that begins with the characters of c.  Multiple commands may be speci Äê
                fied, using multiple  c options.  They are joined in a single ORed set before participating in AND option selection.

                If c begins with a '^', then the following characters specify a command name whose processes are to be ignored (excluded.)

                If c begins and ends with a slash ('/'), the characters between the slashes are interpreted as a regular expression.  Shell meta characters  in  the
                regular expression must be quoted to prevent their interpretation by the shell.  The closing slash may be followed by these modifiers:

                     b    the regular expression is a basic one.
                     i    ignore the case of letters.
                     x    the regular expression is an extended one
                          (default).

                See the lsof FAQ (The FAQ section gives its location.)  for more information on basic and extended regular expressions.

                The  simple  command specification is tested first.  If that test fails, the command regular expression is applied.  If the simple command test suc Äê
                ceeds, the command regular expression test isn't made.  This may result in ``no command found for regex:'' messages when lsof's  V option is  speci Äê
                fied.

       +c w     This  option  defines  the  maximum  number  of  initial characters of the name, supplied by the UNIX dialect, of the UNIX command associated with a
                process to be printed in the COMMAND column.  (The lsof default is nine.)

                Note that many UNIX dialects do not supply all command name characters to lsof in the files and structures from which  lsof  obtains  command  name.
                Often  dialects limit the number of characters supplied in those sources.  For example, Linux 2.4.27 and Solaris 9 both limit command name length to
                16 characters.

                If w is zero ('0'), all command characters supplied to lsof by the UNIX dialect will be printed.

                If w is less than the length of the column title, ``COMMAND'', it will be raised to that length.

        C       This option disables the reporting of any path name components from the kernel's name cache.  See the KERNEL NAME CACHE section  for  more  informa Äê
                tion.

       +d s     This  option  causes  lsof  to search for all open instances of directory s and the files and directories it contains at its top level.  This option
                does NOT descend the directory tree, rooted at s.  The +D D option may be used to request a full descent directory tree search, rooted at  directory
                D.

                Processing  of  the  +d option does not follow symbolic links within s unless the  x or  x  l option is also specified.  Nor does it search for open
                files on file system mount points on subdirectories of s unless the  x or  x  f option is also specified.

                Note: the authority of the user of this option limits it to searching for files that the user has permission to  examine  with  the  system  stat(2)
                function.

        d s     This  option specifies a list of file descriptors (FDs) to exclude from or include in the output listing.  The file descriptors are specified in the
                comma separated set s   e.g., ``cwd,1,3'', ``^6,^2''.  (There should be no spaces in the set.)

                The list is an exclusion list if all entries of the set begin with '^'.  It is an inclusion list if no entry begins with '^'.  Mixed lists  are  not
                permitted.

                A  file descriptor number range may be in the set as long as neither member is empty, both members are numbers, and the ending member is larger than
                the starting one   e.g., ``0 7'' or ``3 10''.  Ranges may be specified for exclusion if they have the '^' prefix   e.g., ``^0 7'' excludes all  file
                descriptors 0 through 7.

                Multiple file descriptor numbers are joined in a single ORed set before participating in AND option selection.

                When there are exclusion and inclusion members in the set, lsof reports them as errors and exits with a non zero return code.

                See the description of File Descriptor (FD) output values in the OUTPUT section for more information on file descriptor names.

       +D D     This option causes lsof to search for all open instances of directory D and all the files and directories it contains to its complete depth.

                Processing  of  the  +D option does not follow symbolic links within D unless the  x or  x  l option is also specified.  Nor does it search for open
                files on file system mount points on subdirectories of D unless the  x or  x  f option is also specified.

                Note: the authority of the user of this option limits it to searching for files that the user has permission to  examine  with  the  system  stat(2)
                function.

                Further note: lsof may process this option slowly and require a large amount of dynamic memory to do it.  This is because it must descend the entire
                directory tree, rooted at D, calling stat(2) for each file and directory, building a list of all the files it finds, and searching that list  for  a
                match with every open file.  When directory D is large, these steps can take a long time, so use this option prudently.

        D D     This option directs lsof's use of the device cache file.  The use of this option is sometimes restricted.  See the DEVICE CACHE FILE section and the
                sections that follow it for more information on this option.

                 D must be followed by a function letter; the function letter may optionally be followed by a path name.  Lsof recognizes these function letters:

                     ?   report device cache file paths
                     b   build the device cache file
                     i   ignore the device cache file
                     r   read the device cache file
                     u   read and update the device cache file

                The b, r, and u functions, accompanied by a path name, are sometimes restricted.  When these functions are restricted, they will not appear  in  the
                description  of  the  D option that accompanies  h or  ?  option output.  See the DEVICE CACHE FILE section and the sections that follow it for more
                information on these functions and when they're restricted.

                The ?  function reports the read only and write paths that lsof can use for the device cache file, the names of any environment variables whose val Äê
                ues lsof will examine when forming the device cache file path, and the format for the personal device cache file path.  (Escape the `?' character as
                your shell requires.)

                When available, the b, r, and u functions may be followed by the device cache file's path.  The standard  default  is  .lsof_hostname  in  the  home
                directory of the real user ID that executes lsof, but this could have been changed when lsof was configured and compiled.  (The output of the  h and
                 ?  options show the current default prefix   e.g., ``.lsof''.)  The suffix, hostname, is the first component of the host's name returned  by  geth Äê
                ostname(2).

                When available, the b function directs lsof to build a new device cache file at the default or specified path.

                The i function directs lsof to ignore the default device cache file and obtain its information about devices via direct calls to the kernel.

                The  r  function  directs lsof to read the device cache at the default or specified path, but prevents it from creating a new device cache file when
                none exists or the existing one is improperly structured.  The r function, when specified without a path name, prevents lsof from updating an incor Äê
                rect or outdated device cache file, or creating a new one in its place.  The r function is always available when it is specified without a path name
                argument; it may be restricted by the permissions of the lsof process.

                When available, the u function directs lsof to read the device cache file at the default or specified path, if possible, and to rebuild it, if  nec Äê
                essary.  This is the default device cache file function when no  D option has been specified.

       +| f [cfgGn]
                f  by  itself  clarifies  how path name arguments are to be interpreted.  When followed by c, f, g, G, or n in any combination it specifies that the
                listing of kernel file structure information is to be enabled (`+') or inhibited (` ').

                Normally a path name argument is taken to be a file system name if it matches a mounted on directory name reported by mount(8), or if it  represents
                a block device, named in the mount output and associated with a mounted directory name.  When +f is specified, all path name arguments will be taken
                to be file system names, and lsof will complain if any are not.  This can be useful, for example, when the  file  system  name  (mounted on  device)
                isn't a block device.  This happens for some CD ROM file systems.

                When   f is specified by itself, all path name arguments will be taken to be simple files.  Thus, for example, the `` f    /'' arguments direct lsof
                to search for open files with a `/' path name, not all open files in the `/' (root) file system.

                Be careful to make sure +f and  f are properly terminated and aren't followed by a character (e.g., of the file or file system name) that  might  be
                taken as a parameter.  For example, use ``  '' after +f and  f as in these examples.

                     $ lsof +f    /file/system/name
                     $ lsof  f    /file/name

                The  listing  of  information from kernel file structures, requested with the +f [cfgGn] option form, is normally inhibited, and is not available in
                whole or part for some dialects   e.g., /proc based Linux kernels below 2.6.22.  When the prefix to f is a plus sign (`+'), these characters request
                file structure information:

                     c    file structure use count (not Linux)
                     f    file structure address (not Linux)
                     g    file flag abbreviations (Linux 2.6.22 and up)
                     G    file flags in hexadecimal (Linux 2.6.22 and up)
                     n    file structure node address (not Linux)

                When the prefix is minus (` ') the same characters disable the listing of the indicated values.

                File  structure addresses, use counts, flags, and node addresses may be used to detect more readily identical files inherited by child processes and
                identical files in use by different processes.  Lsof column output can be sorted by output columns holding the values and listed to identify identi Äê
                cal file use, or lsof field output can be parsed by an AWK or Perl post filter script, or by a C program.

        F f     This option specifies a character list, f, that selects the fields to be output for processing by another program, and the character that terminates
                each output field.  Each field to be output is specified with a single character in f.  The field terminator defaults to NL, but may be  changed  to
                NUL (000).  See the OUTPUT FOR OTHER PROGRAMS section for a description of the field identification characters and the field output process.

                When the field selection character list is empty, all standard fields are selected (except the raw device field, security context and zone field for
                compatibility reasons) and the NL field terminator is used.

                When the field selection character list contains only a zero (`0'), all fields are selected (except the raw device field for compatibility  reasons)
                and the NUL terminator character is used.

                Other  combinations of fields and their associated field terminator character must be set with explicit entries in f, as described in the OUTPUT FOR
                OTHER PROGRAMS section.

                When a field selection character identifies an item lsof does not normally list   e.g., PPID, selected with  R   specification of the field  charac Äê
                ter   e.g., `` FR''   also selects the listing of the item.

                When  the  field  selection  character list contains the single character `?', lsof will display a help list of the field identification characters.
                (Escape the `?' character as your shell requires.)

        g [s]   This option excludes or selects the listing of files for the processes whose optional  process  group  IDentification  (PGID)  numbers  are  in  the
                comma separated set s   e.g., ``123'' or ``123,^456''.  (There should be no spaces in the set.)

                PGID numbers that begin with `^' (negation) represent exclusions.

                Multiple  PGID  numbers  are joined in a single ORed set before participating in AND option selection.  However, PGID exclusions are applied without
                ORing or ANDing and take effect before other selection criteria are applied.

                The  g option also enables the output display of PGID numbers.  When specified without a PGID set that's all it does.

        i [i]   This option selects the listing of files any of whose Internet address matches the address specified in i.  If no address is specified, this  option
                selects the listing of all Internet and x.25 (HP UX) network files.

                If   i4  or  i6 is specified with no following address, only files of the indicated IP version, IPv4 or IPv6, are displayed.  (An IPv6 specification
                may be used only if the dialects supports IPv6, as indicated by ``[46]'' and ``IPv[46]'' in lsof's  h or  ?  output.)  Sequentially specifying   i4,
                followed by  i6 is the same as specifying  i, and vice versa.  Specifying  i4, or  i6 after  i is the same as specifying  i4 or  i6 by itself.

                Multiple  addresses  (up  to  a  limit  of  100)  may be specified with multiple  i options.  (A port number or service name range is counted as one
                address.)  They are joined in a single ORed set before participating in AND option selection.

                An Internet address is specified in the form (Items in square brackets are optional.):

                [46][protocol][@hostname|hostaddr][:service|port]

                where:
                     46 specifies the IP version, IPv4 or IPv6
                          that applies to the following address.
                          '6' may be be specified only if the UNIX
                          dialect supports IPv6.  If neither '4' nor
                          '6' is specified, the following address
                          applies to all IP versions.
                     protocol is a protocol name   TCP, UDP
                     hostname is an Internet host name.  Unless a
                          specific IP version is specified, open
                          network files associated with host names
                          of all versions will be selected.
                     hostaddr is a numeric Internet IPv4 address in
                          dot form; or an IPv6 numeric address in
                          colon form, enclosed in brackets, if the
                          UNIX dialect supports IPv6.  When an IP
                          version is selected, only its numeric
                          addresses may be specified.
                     service is an /etc/services name   e.g., smtp  
                          or a list of them.
                     port is a port number, or a list of them.

                IPv6 options may be used only if the UNIX dialect supports IPv6.  To see if the dialect supports IPv6, run lsof and specify the   h  or   ?   (help)
                option.  If the displayed description of the  i option contains ``[46]'' and ``IPv[46]'', IPv6 is supported.

                IPv4 host names and addresses may not be specified if network file selection is limited to IPv6 with  i 6.  IPv6 host names and addresses may not be
                specified if network file selection is limited to IPv4 with  i 4.  When an open IPv4 network file's address is mapped in an IPv6 address,  the  open
                file's type will be IPv6, not IPv4, and its display will be selected by '6', not '4'.

                At least one address component   4, 6, protocol, ,IR hostname , hostaddr, or service   must be supplied.  The `@' character, leading the host speci Äê
                fication, is always required; as is the `:', leading the port specification.  Specify either hostname or hostaddr.  Specify either service name list
                or  port  number list.  If a service name list is specified, the protocol may also need to be specified if the TCP, UDP and UDPLITE port numbers for
                the service name are different.  Use any case   lower or upper   for protocol.

                Service names and port numbers may be combined in a list whose entries are separated by commas and whose numeric  range  entries  are  separated  by
                minus  signs.  There may be no embedded spaces, and all service names must belong to the specified protocol.  Since service names may contain embed Äê
                ded minus signs, the starting entry of a range can't be a service name; it can be a port number, however.

                Here are some sample addresses:

                      i6   IPv6 only
                     TCP:25   TCP and port 25
                     @1.2.3.4   Internet IPv4 host address 1.2.3.4
                     @[3ffe:1ebc::1]:1234   Internet IPv6 host address
                          3ffe:1ebc::1, port 1234
                     UDP:who   UDP who service port
                     TCP@lsof.itap:513   TCP, port 513 and host name lsof.itap
                     tcp@foo:1 10,smtp,99   TCP, ports 1 through 10,
                          service name smtp, port 99, host name foo
                     tcp@bar:1 smtp   TCP, ports 1 through smtp, host bar
                     :time   either TCP, UDP or UDPLITE time service port

        k k     This option specifies a kernel name list file, k, in place of /vmunix, /mach, etc.  This option is not available under AIX on  the  IBM  RISC/System
                6000.

        l       This option inhibits the conversion of user ID numbers to login names.  It is also useful when login name lookup is working improperly or slowly.

       +| L [l] This  option enables (`+') or disables (` ') the listing of file link counts, where they are available   e.g., they aren't available for sockets, or
                most FIFOs and pipes.

                When +L is specified without a following number, all link counts will be listed.  When  L is specified (the default), no link counts will be listed.

                When +L is followed by a number, only files having a link count less than that number will be listed.  (No number may follow  L.)   A  specification
                of  the  form  ``+L1'' will select open files that have been unlinked.  A specification of the form ``+aL1 <file_system>'' will select unlinked open
                files on the specified file system.

                For other link count comparisons, use field output ( F) and a post processing script or program.

       +| m m   This option specifies an alternate kernel memory file or activates mount table supplement processing.

                The option form  m m specifies a kernel memory file, m, in place of /dev/kmem or /dev/mem   e.g., a crash dump file.

                The option form +m requests that a mount supplement file be written to the standard output file.  All other options are silently ignored.

                There will be a line in the mount supplement file for each mounted file system, containing the mounted file system directory, followed by  a  single
                space, followed by the device number in hexadecimal "0x" format   e.g.,

                     / 0x801

                Lsof can use the mount supplement file to get device numbers for file systems when it can't get them via stat(2) or lstat(2).

                The option form +m m identifies m as a mount supplement file.

                Note:  the +m and +m m options are not available for all supported dialects.  Check the output of lsof's  h or  ?  options to see if the +m and +m m
                options are available.

       +| M     Enables (+) or disables ( ) the reporting of portmapper registrations for local TCP, UDP and UDPLITE ports.  The default reporting mode  is  set  by
                the lsof builder with the HASPMAPENABLED 

Related Topics