How to Use the lsof Command to List Open Files in Linux

In Linux, everything is a file. This is not just a philosophy; it is a literal architectural rule. When a program reads a text document, it opens a file. When a web server listens on port 80, it opens a file. When you insert a USB drive, the system interacts with it as a file.

Because everything revolves around files, knowing exactly which processes are accessing which files at any given moment is a superpower for system administrators. If you cannot unmount a USB drive because “a process is using it,” or if you need to know what application is stealthily writing data to a hidden log, you need the lsof (List Open Files) command.

In this guide, you will learn how to use lsof to peer under the hood of your Linux operating system and identify rogue processes.

The Basic lsof Command

If you open a terminal and simply type lsof and press Enter, it will output a massive list of every single file currently open across the entire operating system. This is usually thousands of lines long and completely unreadable.

To use lsof effectively, you must combine it with specific flags to filter the output down to exactly what you are looking for.

Note: Because lsof needs to inspect the entire system, you must run it with sudo (root privileges) to get accurate results.

Use Case 1: Finding Who is Using a Specific File or Directory

Imagine you are trying to delete a massive log file (e.g., /var/log/syslog), but the system throws a “File in use” error. You need to know which background daemon is holding it hostage.

sudo lsof /var/log/syslog

This command will output a neat table showing the COMMAND (the program name, like rsyslogd), the PID (Process ID), the USER running it, and the type of lock they have on the file. You can then use the kill command alongside that PID to terminate the offending program.

You can also run this against an entire directory or mount point. If your USB drive is mounted at /mnt/usb and refuses to eject:

sudo lsof +D /mnt/usb

The +D flag tells lsof to scan the directory and all of its subdirectories, revealing every process currently interacting with the drive.

Use Case 2: Finding Files Opened by a Specific User

If you suspect a specific user account on a shared server is running a script that is chewing up resources, you can isolate all files opened by that specific user using the -u flag.

To see all files opened by the user “james”:

sudo lsof -u james

To invert this and see all files opened by everyone except the root user (which filters out 90% of standard system noise), use the caret (^) symbol:

sudo lsof -u ^root

Use Case 3: Finding the Exact Executable of a Running Process

Sometimes you see a strange process named “backup-daemon” running in your top monitor, but you have no idea where the actual script lives on your hard drive.

If you know the Process ID (PID) of the strange program (e.g., PID 4052), you can use the -p flag to inspect it:

sudo lsof -p 4052

This will list every file that specific PID has open, including the absolute path to the main executable binary, any configuration files it is reading, and any log files it is writing to. It is the ultimate forensic tool for dissecting unfamiliar software.