lsof examples

List a User's Open Files

lsof -u
If you want to look at the files a particular user has open (and remember that those include network connections and devices, among many others), add the -u option to lsof, followed by the username (remember that lsof must be run as root).

Note
In order to save space, some of the data you'd normally see when you run lsof has been removed in this and further examples.

# lsof -u scott

List Users for a Particular File

lsof [file]
In the previous section, you saw what files a particular user had open. Let's reverse that, and see who's using a particular file. To do so, simply follow lsof with the path to a file on your system. For instance, let's take a look at who's using the SSH daemon, used to connect remotely to this computer (remember that lsof must be run as root).


List Processes for a Particular Program

To find out the full universe of other files associated with a particular running program, follow lsof with the -c option, and then the name of a running (and therefore "open") program

lsof -c [program]

Ex:

# lsof -c sshd
COMMAND PID USER NAME
sshd 10542 root /lib/ld-2.3.5.so
sshd 10542 root /dev/null
sshd 10542 root 192.168.0.170:ssh->192.168.0.100:4577 (ESTABLISHED)
sshd 10548 scott /usr/sbin/sshdp
sshd 10548 scott 192.168.0.170:ssh->192.168.0.100:4577 (ESTABLISHED)


source scott granemann