Lsof options

Just for personal use and taken directly from source: http://www.akadia.com/services/lsof_intro.html

Find top 10 open files programs

 lsof -n | awk '{printf("%s  (%s)\n", $1, $2)}' | sort | uniq -c | sort -rn | head
    866 java  (3019)
     49 sshd  (7290)
     48 sshd  (2084)
     45 sshd  (7049)
     36 avahi-dae  (1609)
     35 lighttpd  (1622)
     31 ntpd  (1328)
     30 sshd  (1304)
     29 exim4  (1635)
     25 rpc.idmap  (917)

Ripoff start

Overview

List Open Files is a useful and powerful tool that will show you opened files. In Unix everything is a file: pipes are files, IP sockets are files, unix sockets are files, directories are files, devices are files, inodes are files…

Useful Examples

So in this tangle of files lsof listst files opened by processes running on your system.

When lsof is called without parameters, it will show all the files opened by any processes.

    lsof | nl

Let us know who is using the apache executable file, /etc/passwd, what files are opened on device /dev/hda6 or who’s accessing /dev/cdrom:

    lsof `which apache2`
    lsof /etc/passwd
    lsof /dev/hda6
    lsof /dev/cdrom

Now show us what process IDs are using the apache binary, and only the PID:

    lsof -t `which apache2`

Show us what files are opened by processes whose names starts by “k” (klogd, kswapd…) and bash. Show us what files are opened by init:

    lsof -c k
    lsof -c bash
    lsof -c init

Show us what files are opened by processes whose names starts by “courier”, but exclude those whose owner is the user “zahn”:

    lsof -c courier -u ^zahn