lsof Cheatsheet - Linux Process & Port Diagnostics Reference
All essential lsof commands organized by use case, with 35+ entries you can copy and run directly. Find the right command fast when you need it.
Back to SysOpsBy Process 6
lsof -p 1234Show指定 PID Open的File
lsof -c nginxShow nginx ProcessOpen的File
lsof -c /^nginx/正则MatchProcess名
lsof -u tomShow指定UserOpen的File
lsof -u ^root排除 root User
lsof -p 1234,5678Show多个ProcessOpen的File
By Port 6
lsof -i :80Showusage 80 Port的Process
lsof -i :8080 -i :8443Show多个Port
lsof -i tcp:80只Show TCP 80 Port
lsof -i udp:53只Show UDP 53 Port
lsof -i @192.168.1.1:80Show指定 IP 和Port
lsof -i :1-1024Show所有特权Port（1-1024）usage
By File 4
lsof /var/log/syslogShow谁Open了指定File
lsof +D /var/log/ShowDirectory下所有Open的File
lsof +d /var/log/只Show当前Directory（不recursively）
lsof /dev/sda1Show谁在使用指定设备
Network 8
lsof -iShow所有NetworkConnection
lsof -i -n不解析域名（更快）
lsof -i -P不解析Port名（Display数字Port）
lsof -i -n -P组合使用（最快）
lsof -i tcp@192.168.1.1:22Show到指定主机的 SSH Connection
lsof -i -sTCP:ESTABLISHED只Show已建立的Connection
lsof -i 4 -P -n只Show IPv4 Connection（不解析加速）
lsof -i 6 -P -n只Show IPv6 Connection
By Type 4
lsof -t只Output PID（方便pipe处理）
lsof -F pfcOutput格式化的field（PID/命令/User）
lsof -a -p 1234 -c nginxAND 组合condition
lsof -Or -p 1234 -p 5678OR 组合condition
Troubleshooting 7
lsof -i :80 | grep LISTENShow 80 Port监听Process
lsof +L1Show已Delete但仍被Open的File（Disk满时用）
lsof -nP -iTCP -sTCP:LISTENShow所有监听中的 TCP Port
lsof -i :22 | grep ESTABLISHEDShow已建立的 SSH Connection
lsof -u tom | wc -l统计UserOpen的File数
kill $(lsof -t -i :8080)一键杀掉usage 8080 Port的Process
lsof -i :80 -r 5每 5 秒重复监控 80 Port
💡 Tips
- lsof 需要 root Permission才能Show所有User的File，普通User只能看自己的。
- Portusage排查：先用 lsof -i :port 找到 PID，再用 kill Kill process或改Configure。
- Disk满但找不到大File时，用 lsof +L1 找已Delete但仍被Processusage的File。
Official References
Commands are compiled from the official docs below. Click to verify the latest usage.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Found an error? Report it
Wrong command or description? Open an issue to help us fix it.
Found an error? Report it