To list all of the files opened by a specific user, type the -u option.
$ lsof -u jill
To list all of the files opened by several specific users, use a comma delimited list.
$ lsof -u jack,jill
To list all of the files opened by every user other than a specific user, use the ^ character. You can use a comma delimited list
$ lsof -u ^jack,jill
list by particular process
To list all of the files opened by a particular process, type the -p option.
$ lsof -p 1234
list particular login names, user IDs or process numbers
To list all open files for any and all of: login name abe, or user ID 1234, or process 456, or process 123, or process 789, type lsof -p 456,123,789 -u 1234,abe. (from the man pages)
$ lsof -p 456,123,789 -u 1234,abe
list by mount point
Sometimes when you attempt to unmount a device or directory, the system will warn you with the Device or resource Busy error.
You can list all of the processes using a mount point and then kill those processes so that you can unmount the device or directory.
$ lsof /home
An equivalent option is:
$ lsof +D /home/
list by device
To list all open files on device /dev/hd4, type lsof /dev/hd4. (from the man pages)
$ lsof /dev/hd4
To kill the process that has /u/abe/foo open (by sending the signal SIGHUP), type kill -HUP `lsof -t /u/abe/foo`. (from the man pages)
$ kill -HUP `lsof /u/abe/foo`
Notice that those are back ticks.
You can also kill all processes that belong to a specific user by using the -t option to output only the process ID and pass that result on to kill.
$ kill -9 `lsof -t -u jill `
lsof defaults to logical OR of all options. The following example (from the man pages) will list all of the files open from all three listed processes and from both users.
$ lsof -p 456,123,789 -u 1234,abe
Use the -a option to perform a logical AND on the user names, processes, etc. Note that you either OR the entire line or AND the entire line. You can not mix AND and OR together in a single lsof command. The ^ negation on login name or user ID, process ID, or process group ID options are evaluated prior to other selection criteria and therefore dont get included in AND or OR for lsof. Although the -a is legal in any position, placing it between a pair of items does not cause just those two items to be ANDed, the entire line is still ANDed.
The following AND example will produce a listing of only UNIX socket files that belong to processes owned by the user foo.
$ lsof -a -U -ufoo
You can gather information at specific time intervals. To list the files at descriptors 1 and 3 of every process running the lsof command for login abe every 10 seconds, type lsof -c lsof -a -d 1 -d 3 -u abe -r10. (from the man pages)
$ lsof -c lsof -a -d 1 -d 3 -u abe -r10
Use the +r or -r options for timed repeats. The +r switch will stop when no open files that meet the selected criteria are open. The -r will continue until interrupted by a signal. The number after the r is the time in seconds for each delay.
Between each cycle, lsof will print a sequence of equal signs ( ======= ).
Because UNIX and Linux (and Mac OS X) treat internet connections as files, you can use the -i switch to view all of your open internet connections.
To list all open Internet, x.25 (HP-UX), and UNIX domain files, type lsof -i -U. (from the man pages)
$ lsof -i -U
IPv4 network files by PID
To list all open IPv4 network files in use by the process whose PID is 1234, type lsof -i 4 -a -p 1234. (from the man pages)
$ lsof -i 4 -a -p 1234
To list all open IPv6 network files (assuming your UNIX system supports IPv6), type lsof -i 6. (from the man pages)
$ lsof -i 6
list by port
List all of the processes that are listening to a particular port by using colon ( : ) followed by the port number(s).
$ lsof -i:21
To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu, type lsof -i @wonderland.cc.purdue.edu:513-515. (from the man pages)
$ lsof -i @wonderland.cc.purdue.edu:513-515
list TCP or UDP connections
List all of the TCP connections:
$ lsof -i tcp
List all of the UDP connections:
$ lsof -i udp
list from default domain
Assuming a default domain of cc.purdue.edu, list all files using any protocol on any port of mace.cc.purdue.edu, type lsof -i @mace. (from the man pages)
$ lsof -i @mace
Network File System (NFS)
List all of the Network File System (NFS) files by using the -N switch.
$ lsof -N
To find processes with open files on the NFS file system named /nfs/mount/point whose server is inaccessible (assuming your mount table supplies the device number for /nfs/mount/point), type lsof -b /nfs/mount/point. (from the man pages)
$ lsof -b /nfs/mount/point
To do the preceding search with warning messages suppressed, type lsof -bw /nfs/mount/point. (from the man pages)
$ lsof -bw /nfs/mount/point
ignore device cache file
To ignore the device cache file, type lsof -Di. (from the man pages)
$ lsof -Di
obtain specific multiple info on each file
You can combine flags to gather specific information. To obtain the PID and command name field for each process, file descriptor, file device number, and file inode number for each file of each process, type lsof -FpcfDi. (from the man pages)
$ lsof -FpcfDi
using regular expressions
To list the current working directory of prcoesses running a command that is exactly four characters long and has an upper or lower case O or o in character position three, type lsof -c /^..o.$/i -a -d cwd. (from the man pages)
$ lsof -c /^..o.$/i -a -d cwd
To find an IP version 4 socket file by its associated numeric dot-form address, type lsof -firstname.lastname@example.org. (from the man pages)
$ lsof -email@example.com
To find an IP version 6 socket file by its associated numeric colon-form address, type lsof -i@[0:1:2:3:4:5:6:7]. (from the man pages)
$ lsof -i@[0:1:2:3:4;5;6:7]
To find an IP version 6 socket file by its associated numeric colon-form address that has a run of zeros in it (such as the loop-back address), type lsof -i@[::1]. (from the man pages)
$ lsof -i@[::1]
free music player coding example
Coding example: I am making heavily documented and explained open source code for a method to play music for free almost any song, no subscription fees, no download costs, no advertisements, all completely legal. This is done by building a front-end to YouTube (which checks the copyright permissions for you).
Work on this project is very slow because I am homeless. I am available for work if someone can provide an indoor place to work in Costa Mesa, California, electricity, internet connections, a flat raised working surface (such as a table or desk), a sitting device (such as a chair or stool), and a fully functional reasonably modern used computer. Im already homeless, so you dont need to pay me (and I understand how much business people hate the minimum wage law). Just give me a chance to work.
Building a free downloadable text book on computer programming for university, college, community college, and high school classes in computer programming.
If you like the idea of this project, then please donate some money.
send donations to: Milo
PO Box 1361
Tustin, California 92781
At the time I am homeless. This greatly interferes with my ability to create this project, which can help nearly 20 million U.S. college students and more than 150 million students world-wide. I am looking for 30 rich people or corporations willing to donate $10 a month to my church so that the church can provide a place indoors for me to continue work. If you want to donate, please see help project. Thanks much.
Supporting the entire project:
If you have a business or organization that can support the entire cost of this project, please contact Pr Ntr Kmt (my church)
UNIX used as a generic term unless specifically used as a trademark (such as in the phrase UNIX certified). UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company Ltd.
Names and logos of various OSs are trademarks of their respective owners.