lsof

List open files by process Show all files (sockets, regular, pipes) opened by nginx lsof -p $(pgrep nginx) | head -30 #lsof#linux#debug Who is using a port Find which process is listening on port 8080 lsof -i :8080 #lsof#linux#network#debug List all network connections Show all open network connections without DNS resolution lsof -i -n -P #lsof#linux#network Find open files on a filesystem Show all processes with open files under /var/log lsof +D /var/log #lsof#linux#debug Find deleted files still held open Find files deleted but still held open by processes (disk bloat) lsof | grep '(deleted)' #lsof#linux#debug ss: show listening sockets Show TCP listening ports with process names ss -tlnp #lsof#linux#network ss: show all TCP connections Filter established TCP connections with process info ss -tanp | grep ESTAB #lsof#linux#network ss: show UDP sockets List UDP listening ports with process names ss -ulnp #lsof#linux#network ss: socket stats summary Print socket usage summary by state ss -s #lsof#linux#network#monitoring ss: filter by destination port Show connections going TO port 443 ss -tnp dst :443 #lsof#linux#network Find owner of port Show which process owns a port; -nP skips DNS/service name lookups for speed lsof -nP -i :<port> #lsof#network#troubleshooting#debug All listening sockets List every TCP listener with PID, no name resolution; modern: ss -ltnp lsof -nP -iTCP -sTCP:LISTEN #lsof#network#monitoring#troubleshooting Deleted open files Find unlinked files still held open eating disk; df shows full but du does not lsof +L1 #lsof#disk#troubleshooting#debug Who holds a file before umount Reveal processes blocking a 'device busy' umount; pass the mountpoint path lsof /mnt/<name> #lsof#disk#troubleshooting#debug Free a stuck port Kill whatever owns a port; -t prints bare PIDs, -r avoids running kill on empty input lsof -t -i:<port> | xargs -r kill #lsof#network#troubleshooting#debug Detect CLOSE_WAIT leaks Spot sockets the app forgot to close; growing CLOSE_WAIT = fd/connection leak lsof -nP -i -sTCP:CLOSE_WAIT #lsof#network#performance#troubleshooting Connections to remote host Show only sockets talking to a specific peer host/port, both ends matched lsof -nP -i @<host>:<port> #lsof#network#monitoring#debug Binaries and libs of a PID Show only mapped executable and shared libs; -a ANDs the filters, great after a deploy lsof -p <pid> -a -d txt,mem #lsof#debug#troubleshooting#performance Count open fds of a PID Quick fd count to spot leaks vs ulimit -n; faster: ls /proc/<pid>/fd | wc -l lsof -nP -p <pid> | wc -l #lsof#performance#troubleshooting#debug