In the Linux operating system, there is a fundamental philosophy: “Everything is a file.” Text documents are files, directories are files, network sockets are files, and hardware devices are treated as files. Because of this, tracing exactly which application is interacting with a specific file is critical for system administration and troubleshooting.
If you try to unmount a USB drive and receive a “Device is busy” error, or if you try to delete a massive log file but the disk space does not free up, it is because a background process currently holds that file open. To force the system to release the file, you must first identify which process is holding it hostage.
This is where the lsof (List Open Files) command becomes an indispensable tool. This guide explains how to use lsof to track down open files in the Ubuntu terminal.
The Basic lsof Command
If you simply open your terminal and type lsof (and press Enter), the system will output a staggering list of tens of thousands of files currently open across the entire operating system. This raw output is almost completely useless for troubleshooting.
To make the command useful, you must filter the output by providing specific arguments.
How to Find What is Keeping a File Open
The most common scenario is knowing exactly which file is stuck, but not knowing which application is holding onto it. For example, if you cannot delete a file named database_backup.sql, you can ask lsof who has it open.
Type the command followed by the absolute path to the file:
lsof /var/backups/database_backup.sqlThe output will display a clean table showing the COMMAND (the name of the program, e.g., mysqldump), the PID (the Process ID number), and the USER (the account running the program). Armed with the PID, you can now use the kill command to terminate that specific process and release your file.
How to Find All Open Files in a Directory
If you are trying to unmount an entire USB drive (mounted at /media/usb/) and receiving a “target is busy” error, you can instruct lsof to list any file open anywhere within that specific directory structure using the +D (Directory) flag.
lsof +D /media/usb/This will instantly list all the background scripts, open text editors, or rogue terminal windows that are actively reading or writing to the flash drive, allowing you to close them and safely eject the hardware.
How to Find Files Opened by a Specific User
If you are administering a multi-user server and suspect a specific user is hogging resources or running unauthorized scripts, you can filter the open files list by username using the -u flag.
For example, to see every file currently being accessed by the user “john”, run:
lsof -u john(Note: You may need to run this command using sudo if you are querying a user account other than your own).
How to Find Files Opened by a Specific Program
Conversely, if you suspect a specific application (like the Apache web server) is behaving erratically, you can ask lsof to list all the log files, configuration files, and network sockets that program currently has open using the -c (Command) flag:
lsof -c apache2This is an excellent way to quickly locate where a new application is storing its hidden configuration files or dumping its error logs without having to search through the documentation.