In Linux, almost everything is treated as a file. This includes standard text documents, directories, hardware devices, and even active network sockets. When troubleshooting a stubborn system issue—like a USB drive that refuses to unmount because it is “busy,” or a web server failing to bind to a port—you need to know exactly which processes are interacting with which files.
The lsof (List Open Files) command is the definitive diagnostic tool for this task.
Basic Usage: Listing All Open Files
If you execute the command by itself, it will output a massive list of every single file currently opened by every active process on the system.
lsof
Because the output can easily exceed thousands of lines, it is best practice to pipe the results into less for easier reading:
lsof | less
Finding Processes Using a Specific File or Directory
The most common use case for lsof is identifying the culprit preventing you from unmounting a drive or deleting a directory.
To see exactly which process is holding a specific file open, provide the absolute path to the file as an argument:
lsof /var/log/syslog
If you are trying to unmount a USB drive at /mnt/usb but the system claims it is busy, you can search the entire directory recursively using the +D flag:
lsof +D /mnt/usb
The output will list the Command name, the PID (Process ID), and the User. You can then use the kill command with that PID to terminate the offending process and safely unmount the drive.
Finding Network Connections
Because Linux treats network sockets as files, lsof is incredibly useful for network diagnostics. You can use the -i flag to list all active network connections and the applications using them.
lsof -i
To be more specific, you can search for a process occupying a specific TCP port (for example, to find out what is conflicting with your Apache server on port 80):
lsof -i TCP:80
Note: Many files and network sockets are owned by the root user. If you are not seeing the results you expect, ensure you prepend the command with sudo.