How to List Open Files and Processes Using the lsof Command in Linux

When you cannot mathematically unmount a USB drive on a Linux server because the system reports the device is “busy,” or when you need to identify exactly which rogue process is bound to a specific network port, standard process monitors will fail. To force the Linux kernel to algorithmically scan its internal file descriptors and dump a comprehensive matrix of every single open file and the process controlling it, you must deploy the lsof command.

Executing the File Descriptor Extraction

The lsof (List Open Files) command is a highly privileged forensic engine. Because Linux treats everything—from standard text documents to hardware devices, network sockets, and directories—as a “file,” lsof exposes the absolute bedrock architecture of your system’s active operations.

Executing a Basic Mount Point Diagnostic

Imagine you have a USB drive mounted at /mnt/usb_backup. The umount command fails because a process is actively reading or writing data. You must execute a targeted extraction.

To pinpoint the exact process, open your terminal (you must use sudo to access root-level descriptors) and type:

sudo lsof /mnt/usb_backup

The exact millisecond you press Enter, the lsof engine bypasses the standard file system and interrogates the kernel. It outputs a highly structured table showing the COMMAND (the name of the program, e.g., rsync), the numerical PID (e.g., 14592), the USER executing the command, and the exact absolute path of the file holding the mount point hostage. You can now use the kill command to violently terminate PID 14592 and free the drive.

Targeting Active Network Sockets

If you suspect a rogue application is secretly broadcasting data on a specific network port (e.g., Port 8080), you can force lsof to mathematically scan the TCP/IP stack.

To execute a network socket extraction, inject the -i (internet) flag, followed by a colon and the exact port integer.

sudo lsof -i :8080

The engine will instantly scan the active network matrix and dump the exact PID of the application (e.g., a rogue Python script) bound to Port 8080, allowing you to neutralize the threat.