List Opening Files
lsof or LiSt Open Files is used to find out which files are open by which process
Watch Network Service Activity in Real-time
Show apps that use internet connection at the moment
Capture all files that is being used by a package
To list all IPv4 network files
To list all IPv6 network files
To list all listening ports
lsof -Pnl -i4TCP -sTCP:LISTEN
To find which program is using the port 80
To list all connections to a specific host
To list all processes accessing a particular file/directory
To list all files open for a particular user
To list all files/network connections a command is using
Show listening tools
lsof -nP -iTCP -sTCP:LISTEN
Show ip-addresses connected to a port
lsof -nP -iTCP:443 -sTCP:LISTEN
Show ip-addresses connected to a port by ip-number
lsof -iTCP -sTCP:LISTEN -P -n
Kill all Activity of Particular User
kill -9 `lsof -t -u username`
List open files that have no links to them on the filesystem
Show apps that use internet connection at the moment.
lsof -P -i -n | cut -f 1 -d " "| uniq | tail -n +2
List processes with established tcp connections (without netstat)
lsof -i -n | grep ESTABLISHED
List files opened by a pid
Check open ports without netstat or lsof
declare -a array=($(tail -n +2 /proc/net/tcp | cut -d":" -f"3"|cut -d" " -f"1")) && for port in ${array[@]}; do echo $((0x$port)); done
Determine if tcp port is open
Find size in megabyte of files that are deleted but still in use and therefore consumes diskspace
lsof -ns | grep REG | grep deleted | awk '{s+=$7} END {printf "%.2f MB\n", s/1024/1024}'
Show top running processes by the number of open filehandles they have
lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head
Check open ports (both ipv4 and ipv6)
List all opened ports on host
lsof -P -i -n -sTCP:LISTEN
List Active Listening Ports for Firewall Configuration
lsof -nP -i | awk '{print $9, $8, $1}' | sed 's/.*://' | sort -u
Show Disk Space Still Used by Deleted Files (Per Process)
lsof -ns | grep REG | grep deleted | awk '{a[$1]+=$7;}END{for(i in a){printf("%s %.2f MB\n", i, a[i]/1048576);}}'
List all the files that have been deleted while they were still open
lsof | egrep "^COMMAND|deleted"
To find the count of each open file on a system (that supports losf)
lsof | awk '{printf("%s %s %s\n", $1, $3, $NF)}' | grep -v "(" | sort -k 4 | gawk '$NF==prv{ct++;next} {printf("%d %s\n",ct,$0);ct=1;prv=$NF}' | uniq | sort -nr
Find out which directories in /home have the most files currently open
lsof |awk ' {if ( $0 ~ /home/) print substr($0, index($0,"/home") ) }'|cut -d / -f 1-4|sort|uniq -c|sort -bgr
Show apps that use internet connection at the moment. (Multi-Language)
Check open ports (both ipv4 and ipv6)
Which program is this port belongs to ?
Show apps that use internet connection at the moment.
lsof -P -i -n | cut -f 1 -d " "| uniq | tail -n +2
Show all established tcp connections on os x
lsof -iTCP -sTCP:ESTABLISHED | awk '{print $1}' | sort -u
Lists all listening ports together with the PID of the associated process
List all files opened by a particular command
List processes playing sound
List all open ports and their owning executables
lsof -i -P | grep -i "Listen"
List open files that have no links to them on the filesystem
Show established network connections
View network activity of any application or user in realtime
List the files any process is using
Show top running processes by the number of open filehandles they have
lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head
Find wich ports you probably want to open in your firewall on a fresh installed machine
lsof -i -nlP | awk '{print $9, $8, $1}' | sed 's/.*://' | sort -u
Discovering all open files/dirs underneath a directory
List programs with open ports and connections
List pr. command in megabytes sum of deleted files that are still in use and therefore consumes diskspace
lsof -ns | grep REG | grep deleted | awk '{a[$1]+=$7;}END{for(i in a){printf("%s %.2f MB\n", i, a[i]/1048576);}}'
Find the process that is using a certain port e.g. port 3000
Check which files are opened by Firefox then sort by largest size.
lsof -p $(pidof firefox) | awk '/.mozilla/ { s = int($7/(2^20)); if(s>0) print (s)" MB "$9 | "Sort -rn" }'
Which process is accessing the CDROM
lsof -n | grep /media/cdrom
Show which process is blocking umount (Device or resource is busy)
Keep a copy of the raw Youtube FLV,MP4,etc stored in /tmp/
lsof -n -P|grep FlashXX|awk '{ print "/proc/" $2 "/fd/" substr($4, 1, length($4)-1) }'|while read f;do newname=$(exiftool -FileModifyDate -FileType -t -d %Y%m%d%H%M%S $f|cut -f2|tr '\n' '.'|sed 's/\.$//');echo "$f -> $newname";cp $f ~/Vids/$newname;done
Find listening ports by pid
lsof -nP +p 24073 | grep -i listen | awk '{print $1,$2,$7,$8,$9}'
List all active access_logs for currently running Apache or Lighttpd process
lsof -p $(netstat -ltpn|awk '$4 ~ /:80$/ {print substr($7,1,index($7,"/")-1)}')| awk '$9 ~ /access.log$/ {print $9| "Sort -u"}'
Give me back my sound card
lsof /dev/snd/pcm*p /dev/dsp | awk ' { print $2 }' | xargs kill
The program listening on port 8080 through IPv6
Which process has a port open
Keep track of diff progress
lsof -c diff -o -r1 | grep $file
Which processes are listening on a specific port (e.g. port 80)
lsof -iTCP:80 -sTCP:LISTEN
List open IPv4 connections
Find out which directories in /home have the most files currently open
lsof |awk ' {if ( $0 ~ /home/) print substr($0, index($0,"/home") ) }'|cut -d / -f 1-4|sort|uniq -c|sort -bgr
List .log files open by a pid
lsof -p 1234 | grep -E "\.log$" | awk '{print $NF}'
Find established tcp connections without using netstat!!
lsof -i -n | grep ESTABLISHED
List files opened by a PID
List processes with established tcp connections (without netstat)
lsof -i -n | grep ESTABLISHED
Find size in kilobyte of files that are deleted but still in use and therefore consumes diskspace
lsof -ns | grep REG | grep deleted | awk '{s+=$7/1024} END {print s}'
Monitoring file handles used by a particular process
lsof -c <process name> -r
View details of network activity, malicious or otherwise within a port range.
Show the working directories of running processes
lsof -bw -d cwd -a -c java
Kill all processes using a directory/file/etc
lsof|grep /somemount/| awk '{print $2}'|xargs kill
List all the files that have been deleted while they were still open.
lsof | egrep "^COMMAND|deleted"
View internet connection activity in a browser
lsof -nPi | txt2html > ~/lsof.html
Show a listing of open mailbox files (or whatever you want to modify it to show)
lsof | grep "/var/spool/mail/"
List current processes writing to hard drive
lsof | grep -e "[[:digit:]]\+w"
Top 15 processes with the largest number of open files
lsof +c 15 | awk '{print $1}' | sort | uniq -c | sort -rn | head
Show what PID is listening on port 80 on Linux
Find all open files by named process
lsof -c $processname | egrep 'w.+REG' | awk '{print $9}' | sort | uniq
Find out which process uses an old lib and needs a restart after a system update
lsof | grep 'DEL.*lib' | sort -k1,1 -u
Find the delete file ,which is in use
Truncate deleted files from lsof
lsof|gawk '$4~/txt/{next};/REG.*\(deleted\)$/{printf ">/proc/%s/fd/%d\n", $2,$4}'
View internet connection activity in a browser
lsof -nPi | txt2html > ~/lsof.html | gnome-open lsof.html
Check to see what is running on a specific port number
lsof -iTCP:8080 -sTCP:LISTEN
List open file descriptor count by PID
lsof | cut -f 1 -d ' ' | uniq -c | sort -rn | head -n 10
Check which program is using certain port
Identify active network connections
lsof -i -P +c 0 +M | grep -i "$1"
Display 10 biggest open files
lsof / | awk '{ if($7 > 1048576) print $7/1048576 "MB "$9 }' | sort -n -u | tail
Lsof - cleaned up for just open listening ports, the process, and the owner of the process
Grabs Open Files and Then Greps Them
Display any udp/tcp connections by process name or by process id
lsof -nP -c COMMAND | egrep -o '(TCP|UDP).*$' | sort -u
Show all listening and established ports TCP and UDP together with the PID of the associated process
Display IP addresses Pidgin IM Client is connected to
lsof -p `pidof pidgin` | awk '{ print $9 }'|egrep `hostname` | grep -o ">[^:]\+:" | tr -d ":>" | while read line; do host $line; done;
Print all open regular files sorted by the number of file handles open to each.
lsof -a -d 1-99 -Fn / | grep ^n | cut -b2- | sort | uniq -c | sort -n
What?s running on a given port on your machine?
List open ports on a local Linux system
List the open files for a particular process ID
To see which software currently open in directory /var/cache
lsof -Pn +D /var/cache/ | awk '{print $1}' | sort | uniq
Truncate deleted files from lsof
lsof | grep -i deleted | grep REG | grep -v txt | ruby -r 'pp' -e 'STDIN.each do |v| a = v.split(/ +/); puts `:> /proc/#{a[1]}/fd/#{a[3].chop}`; end'
Dynamically list open files for a given process name
lsof -i -n -P | grep -e "$(ps aux | grep node | grep -v grep | awk -F' ' '{print $2}' | xargs | awk -F' ' '{str = $1; for(i = 2; i < NF; i++) {str = str "\\|" $i} print str}')"
Two command output
lsof -i :80 | tee /dev/stderr | wc -l
This will kill all ssh connections from a given host it does give some errors but it does work
lsof -i tcp:22 | grep 192.168.10.10 | awk "{print $2}" |xargs kill
For finding out if something is listening on a port and if so what the daemon is.
The program listening on port 8080 through IPv6
lsof -Pnl +M -i6 | grep 8080
Pid list by httpd listen port
lsof | awk '/*:https?/{print $2}' | sort -u
View open file descriptors for a process.
lsof -p <process_id> | wc -l
Check open ports (both ipv4 and ipv6)
Show the processes that use old libs and need a restart
lsof | grep 'DEL.*lib' | cut -f 1 -d ' ' | sort -u