lsof Command Usage and Examples

Sarath Pillai's picture
list open files in linux

Hi all...before getting into lsof command we need to remember the most important fact in Linux/Unix industry ie; "everything is a file". Even devices,sockets,all are files.

Now lsof stands for "List Open Files", which is used by unix like system to show all open files and processes that opened them. Thanks to Vic Abell who developed this tool for the first time.

If you are interested in understanding all aspects of processes in linux, then i will suggest to read the below article.

Read: Understanding Processes in Linux

the command without any option will give you all opened files in the system by different process.

the above shown output is the simple lsof command output..most of the columns are self explanatory..

FD statnds for file discriptor. the values of file discriptor can be as follows.

  • cwd – Current Working Directory
  • txt – Text file
  • mem – Memory mapped file
  • mmap – Memory mapped device

TYPE stands for type of the whether its a directory or regular file etc

At times in linux machine you encounter issues like one service is not getting binded to the port you want to...because that port might already be used by some other service running. so we nned to find that process and kill that process first.

this can be achieved by the following command.

#lsof -i :<port>

i will show u the output of my 80 port in that case.

then if you want you can kill all the PID's using that port.

Now what if if you want to use lsof to see what all files are opened by a command. for example the below command

lsof -c httpd

will show you some thing as below:

so i can see fro the above picture that httpd command opened what so files.

-c in the above command stands for command. and -i in the previous one stands for internet.


if you want to see what processes opened a specific file you can do the following command(pass the filename as argument).

lsof /var/log/httpd/access_log

i can see from the above picture that access_log is accessed by httpd process with those pids.

Now sometimes you might have experienced an issue, when umounting a drive as below.

Mount: device is busy

in that case we need to check which process are using that device file just as we checked for /var/log/httpd/access_log , like as below:

lsof /dev/sdb

and kill all the pids using them and then try unmounting.

You can also check which files are opened under a specific directory by the following command.

lsof +D /var/log/

the above shown is the output for my /var/log directory.

lsof can be used to list files opened by a user also by the following way.

#lsof -u <username>

list of files opened except by the given user.

lsof -u ^<username>

you can also pass the PID number as the argument to lsof to list all files opened by that process id as below:

lsof -p <pid>

Now imagine a situation where your machine is taking a lot of load due to processes run by a particular user...and if you want to kill all the process run by that user, we can easily achieve that by the following command.

kill -9 `lsof -t -u <username>`

suppose you know that a process is taking load and want to list all the network sockets and files opened by that process then use the below command to do that.

lsof -i -a -p <PID>
Rate this article: 
Average: 4.4 (354 votes)


i m trying to kill a process running on port say 4723…by using command “kill `lsof -t -i:4723`”… works fine..but i need to pass variable in lsof command instead of giving directly 4723…like..

var number = 4723;
“kill `lsof -t -i:number`”
is it possible…? and how..plz replyyy soon..thanks in advance


slashmaster's picture

Hi amit,

You can assign the pid number obtained from the lsof command in a bash shell script as shown below.

pid=`lsof -t -i:25`
kill -9 $pid

In the above shown example of assigning the pid number for the process thats running on the port 25, we have used a variable "pid", and then later on we have used that variable in the kill command to kill the process.

But as you mentioned, why do you want to assign the pid to a variable, when you can directly kill the pid by using the command

kill -9 `lsof -t -i25`


actualy i working on node,js code and need to free the port, and the port is not static..i mean it will be changed i want to make a variable which hold the port number..and user just need to pass the value of port whatever he/she want....

Thanks for the replyyy

slashmaster's picture

Hi Amit,

if you want a user to give the port number as an argument as you mentioned, or you will get port number from a script, in both the cases you can use the below bash code(or bash script file) to get it done. its exactly the same bash example, i have shown previously with a simple modification which will take port number as an argument.

pid=`lsof -t -i:$1`
kill -9 $pid

in the above shown code $1 which is used acts as a value which you will supply as the first argument to the command(script file). So if the above code is saved in a file named /opt/scripts/ permission is assumed). then you can simply kill a process on your required port by supplying the port number as an argument. For example, to kill process running on port 25, you can simply run the above script as follows.

/opt/scripts/ 25

You can even use the above mentioned script inside a code, which you told will be getting the port number by assigning the port number fetched by the code to a variable and passing that variable as an argument in the code itself(the below line should be inside the code which will fetch the variable port number, which is assigned to a variable).

<code which will  fetch the port number will go here. which will assign the port number to a variable named variable>

/opt/scripts/ $variable

Hope that works for you. Let me know. thanks.

Thanks for reply ....i followed the same proceedure explained by you..but it doest work...i m able to run the script from my code mentioned below...this code is in node.js( like javascript )

var port = args.port;
var sys = require('sys')
var exec = require('child_process').exec;
var child;
child = exec('sh',[ '/Applications', '/', '/Contents', '/Resources', '/node_modules', '/appium', '/','$port' ], function (error, stdout, stderr) {
sys.print('stdout: ' + stdout);
sys.print('stderr: ' + stderr);
if (error !== null) {
console.log('exec error: ' + error);

but still its not work i knw the problem is in this line below:
child = exec('sh',[ '/Applications', '/', '/Contents', '/Resources', '/node_modules', '/appium', '/','$port' ],

but unable to find it..

reply soon ..

I need to to free a port by running a command kill `lsof -t -i:4723` from a node.js file my code is var sys = require('sys')
var exec = require('child_process').exec;
var child;
child = exec("kill `lsof -t -i:4723`", function (error, stdout, stderr)
sys.print('stdout: ' + value);
sys.print('stderr: ' + stderr);
if (error !== null) {
console.log('exec error: ' + error);
it works fine but it is only for port 4723 and i want to take variabe say portnumber and then use **kill `lsof -t -i:$portnumber`** instead of **kill `lsof -t -i:4723`** and the value for the variable portnumber is obtained from code file

How to do this ?

slashmaster's picture

Hi amit,

I think the problem is with the nodejs code, which you are running. You can call a shell script from nodejs code in multiple ways. One nice method is to ask nodejs to create a child process(spawning a process while running nodejs script).

For doing that you need for first import the child_process library in nodejs. You can do that by the following method.

var spawn = require('child_process').spawn;

Now we can call this spawn in the code by the following method. For example, we have the script named, which we used in the previous example. we need to provide the location as the path where the script file is located, then the arguments to the command, as shown below.

portkill = spawn('sh', ['/opt/scripts/', 'variableportnumber']);

In the above shown code sh is the shell command with two arguments /opt/scripts/ and variableportnumber, which is going to be your port number which is a variable. You can get more information about using bash commands and running linux commands from nodejs script from the official nodejs site.

child process in nodejs

Hope that helps. and let me know.
 works.....thank u very much.....

Hello ,

First of all very very thnks for replying helps a lot to me...

This code works fine for me but the requirement has i need to kill only the subprocess or server process of the app is there an way to identify the server process of an application...
I m using an application Appium and i want to kill only the server process initiated by the Appium application not the GUI of Appium .

Replyy soon plz....

Thanks in advance
Amit Kumar

slashmaster's picture

Hi amit,

I actually didn't get what you ment by" server process".

Are you referring to the parent process? to remain intact and kill all child process?


Heloo i m working on a open source appium written in node.js. appium is for test automation nad support only some gestures of iphone and android . i need to add the pinch gesture in it but unable to find in which file of the appium i need to do the changes. can anyone suggest me how to do this ?

the link for open source is

thanks in advance..


How can i list the text files using lsof

Add new comment

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.