Trace Open Files and Listening Sockets with lsof

Port already in use, or a file that will not let go? lsof shows you which process is holding it, and it is rarely the one you suspected. By the end you will be able to identify the process holding a file, see which program owns a listening TCP socket, and turn the result into script-friendly fields. Allow 10 minutes for the first pass; a busy host can take longer, because permissions and container file systems affect what lsof can inspect.

The examples use lsof 4.95.0 on Linux. Most queries are ordinary, read-only commands, and nothing here changes a service or a file, so there is nothing to undo.

Before you start

1. Open a shell on the Linux machine you want to inspect.
2. Confirm lsof is installed and record its revision.

lsof -v | head -4

Use sudo only when you need to see processes or paths hidden from your own account. Elevated access reveals more data; it does not make a snapshot complete if a file system is unavailable.

1. Inspect one process

Start with a known PID. The shell expands $$ to its own process ID, so there is no placeholder to edit.

lsof -nP -a -p $$ -d 0,1,2

• -p selects a process ID.
• -d selects file descriptors.
• -a is the one people forget. Selection options are normally ORed; -a makes them AND together. Without it, asking for a PID and a descriptor set can return far more than the intersection you meant.
• -n and -P skip host-name lookups and keep ports numeric, so output is quicker and less surprising.

2. Find who has a path open

Give lsof a path and it lists the processes with that file open. Quote paths containing spaces or shell metacharacters.

sudo lsof -nP -- /var/log/syslog

The double hyphen ends lsof's options, so a path beginning with a hyphen is treated as a name, not an option. It is a good habit whenever a command mixes options and file names.

For a directory, choose the scope deliberately:

• +d searches that directory and its immediate contents.
• +D descends the entire tree, and can be slow and memory hungry.

sudo lsof -nP +d /var/log

3. List listening TCP sockets

Use the network selector with an explicit protocol state:

sudo lsof -nP -iTCP -sTCP:LISTEN

• -iTCP limits results to Internet TCP files.
• -sTCP:LISTEN selects the TCP state.
• Keep -nP while investigating. Without -n, addresses may need reverse DNS; without -P, port numbers may become service names. Both slow the query and make output harder to compare with firewall or service configuration.

4. Combine filters without changing the meaning

To ask for one user's network files, make the intersection explicit. Replace alice with the account you are investigating.

sudo lsof -nP -a -u alice -iTCP

• Values in one set are ORed. -u alice,bob means either user.
• Negation comes first. Values beginning with ^ exclude matches, and exclusions are applied before other criteria. Avoid mixing negated and non-negated values in a single -u argument unless you have checked the exact selection you get.

To inspect a command family, use its leading command name:

sudo lsof -nP -c nginx

-c matches command names beginning with the characters you give it. It is not a search of the full command line.

If you need PIDs to feed another command, use -t, which prints only process IDs and suppresses warnings:

lsof -t -c sshd

5. Make output safe for scripts

Aligned columns are fine at a terminal but are not a stable parsing format. -F emits fields, each tagged with a one-character identifier. This selects PID, command, descriptor and name:

sudo lsof -nP -F pcfn -iTCP -sTCP:LISTEN

• One field per line. Each field ends with a newline by default.
• Sets, then files. A process set starts with p, file sets with f; c is the command and n is the name.
• Awkward names? If names can contain newlines or other odd characters, the manpage documents -F pcfn0, which uses NUL field terminators.

Common traps

• Warnings are not "no". Messages such as can't stat() ... mean lsof could not inspect part of the system. Do not treat that as proof nothing is using a file. Retry the same narrow query with sudo, then investigate the named mount or namespace if the warning stays. Container overlay and namespace file systems commonly make host-wide queries noisy.
• Empty can mean invisible. You only see files of processes your account may inspect, and access controls still limit detail. A blank result can mean "not open" or "not visible to this query". Keep the exact command, stderr warnings and time of the snapshot with any incident notes.
• Repeat mode is not proof. +r 5 repeats every five seconds; stop it with Ctrl-C, and do not treat it as evidence of a stable state.