How to Use the lsof Command in Linux to Find Open Files and Identify Locked Processes

In UNIX and Linux operating systems, the foundational design philosophy states that everything is a file. Hardware devices, directory structures, network sockets, shared memory blocks, and pipe streams are all represented as file descriptors within the kernel. When a filesystem refuses to unmount with a device is busy error, or when an application mysteriously fails to bind to a network port, the lsof (List Open Files) utility is the definitive diagnostic tool for revealing which active process is holding the descriptor open.

Basic Syntax and Fundamental Behavior of lsof

Executing lsof without any parameters lists every open file held by every active process across the entire operating system. Because modern Linux systems maintain tens of thousands of open descriptors, running plain lsof floods the terminal. To isolate actionable data, targeted operational flags must be employed:

sudo lsof [options] [target]

Note: Running lsof with sudo or root privileges is mandatory to view processes owned by other system daemons and users.

Essential lsof Command Combinations for Sysadmins

1. Identifying What Process is Locking a File or Directory

If you cannot delete, move, or unmount a specific directory (such as /var/log or a USB storage mount /mnt/usb), supply the path directly to lsof:

sudo lsof +D /mnt/usb

The +D parameter recursively traverses the directory tree, printing the Process Name (COMMAND), Process ID (PID), User (USER), and exact file path held open by running processes.

2. Finding Which Process is Listening on a Specific Port

When starting web servers like Nginx or Apache and receiving an Address already in use error, query the port directly using the -i flag:

sudo lsof -i :80
sudo lsof -i :443
sudo lsof -i TCP:22

This command reveals the exact daemon holding the port, its PID, and the connection state (e.g., LISTEN or ESTABLISHED).

3. Listing All Files Opened by a Specific User or Process

To inspect every file currently manipulated by a specific user account (such as www-data) or a specific application PID:

sudo lsof -u www-data
sudo lsof -p 14205

4. Recovering Deleted Files Held Open by Active Processes

In Linux, when an active file (such as a MySQL database log or application dump) is deleted using rm, the storage space is not reclaimed if a running process still holds an open file descriptor. To locate these “phantom” deleted files:

sudo lsof | grep deleted

The output reports the PID and the file descriptor number (e.g., 3u). You can instantly recover the deleted content directly from Linux’s virtual /proc filesystem before killing the process:

cp /proc/<PID>/fd/3 /tmp/recovered_file.log

lsof Output Columns Explained

Column Header	Technical Description
COMMAND	Executable name that invoked the open system call.
PID	Process ID assigned by the Linux kernel.
USER	Operating system user account owning the process.
FD	File Descriptor: cwd (current working dir), txt (program code), mem (memory-mapped file), or numeric (e.g. 0u, 1w).
TYPE	Node type: REG (regular file), DIR (directory), CHR (character device), FIFO (pipe), IPv4/IPv6.
NAME	Absolute path of the file or socket destination (IP:Port).

Automating Process Termination with lsof and Kill

To safely terminate all background processes locking an unmountable mount point in a single automated command pipeline, combine lsof with the -t (terse PID only) flag:

sudo kill -9 $(sudo lsof -t +D /mnt/usb)

This command extracts only the PIDs and passes them to kill -9, releasing the locked filesystem immediately.