ServerBuddies Support Blog

How to use lsof command to Find Open Files

The lsof utility can help identify which files are being used by any given application, which network ports are open, and much more.

A process would show up in top or ps aux, but the executable may not seem to exist. Using lsof, we could hunt down the scripts or executables used to run the program. If we run just lsof, it will attempt to show all files (which includes network sockets, pipes and special files) that are open.

If we want to see all the open files owned by a process, we can use the -p option (for PID) like so:

Just replace XXXXX with the process ID (PID) of the process you want to see. The output will show the command that has the file open, the PID, the user, the file descriptor, type, size of the file and the name of the file.

We can also see what files are open by users. Running lsof -u user will show all open files by processes owned by the user. You can also substitute the user ID (UID) for the username. If you want to eliminate a user from the listing, use ^user instead. The preceding caret will negate the selection, so the user will be ignored.

If we want to see what network sockets are owned by a particular user or process? Try ..

That will show only the open TCP and UDP sockets. If we want to see what files are open over the network, use -i. This will show you which files and sockets are open, and their respective protocols, hostnames and so on. We can narrow network parameters down by IP version (-i4 for IPv4, -i6 for IPv6), protocol (UDP or TCP), and even hostname or port.

By default, lsof will look up hostnames, but we can turn this off using the -n option. It will run faster without needing to do name lookups.

lsof 4.81
latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man

How to find open sockets on your Linux server

Here we will look into lsof - list open file, and Nmap (“Network Mapper”)

Nmap is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts.

There are a number of methods that you can use to show open sockets at least:

lsof -U will list open sockets

nmap -sT -sU localhost will scan your local machine for open TCP or UDP ports

Nmap done: 1 IP address (1 host up) scanned in 4.003 seconds

Nmap has lots of options, so we are going to focus on only some of them.

Error: rpmdb open failed

The “rpmdb open failed” error message is mostly received when the rpm databases __db.00* located under /var/lib/rpm directory are corrupted. This results in a “error: cannot open Packages database” message while installation/updatation of a package via yum.

The common fix is to delete the rpm databases and run rebuilddb, like

However, in case of a VPS, yum may still not work with rebuilding rpm database and you have to try create a /dev/urandom device. Login to your VPS and execute

To fix the problem permanently, login to Hardware Node and execute:

Unable to open configuration file /etc/psa/psa.conf: Permission denied

Such errors are reported when Panel spam-filter processes incoming mail to mailbox with the Spamassasin feature enabled. Error is reported because spam-filter hook has no permission to access files in the /etc/psa directory. However, Spamassassin still processes messages correctly so this error does not mean Spamassassin is not working.

To workaround the issue it is possible to add the execute permissions for the /etc/psa folder.

Reference: http://parallels.com/

To list all open files, use:

To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:

To list all open IPv4 network files in use by the process whose PID is 1234, use:

Presuming the UNIX dialect supports IPv6, to list only open IPv6 network files, use:

To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.pur-due.edu, use:

To list all open files for login name “abe”, or user ID 1234, or process 456, or pro-cess 123, or process 789, use:

To list all open files on device /dev/hd4, use:

To find the process that has /u/abe/foo open, use:

To send a SIGHUP to the processes that have /u/abe/bar open, use:

To find any open file, including an open UNIX domain socket file, with the name /dev/log,use: