lsof Cheatsheet - Linux Process & Port Diagnostics Reference
Occupied ports, locked files, a full disk with no large file in sight — all three share one question: which process holds this resource. The sheet is organised along four axes: by process to expand a known PID into its open files and sockets, by port to go the other direction, by file to find its holders, and by type for pipes and memory maps. The least appreciated entry is +L1 under troubleshooting: a deleted file that is still open keeps consuming disk, df will never show it, and only lsof +L1 finds the process holding the dead inode. The division of labour is worth stating — ss and netstat are faster but network-only, fuser can kill directly with -k but gives no connection detail, and /proc is ground truth only if you assemble it yourself. Reach for it when an application reports Address already in use, a log file cannot be written, or umount reports device busy. Budget for permissions: without root you see only your own descriptors, and half a process table is worse than none because it invites false conclusions.
By Process 6
lsof -p 1234lsof -c nginxlsof -c /^nginx/lsof -u tomlsof -u ^rootlsof -p 1234,5678By Port 6
lsof -i :80lsof -i :8080 -i :8443lsof -i tcp:80lsof -i udp:53lsof -i @192.168.1.1:80lsof -i :1-1024By File 4
lsof /var/log/sysloglsof +D /var/log/lsof +d /var/log/lsof /dev/sda1Network 8
lsof -ilsof -i -nlsof -i -Plsof -i -n -Plsof -i tcp@192.168.1.1:22lsof -i -sTCP:ESTABLISHEDlsof -i 4 -P -nlsof -i 6 -P -nBy Type / Format 4
lsof -tlsof -F pfclsof -a -p 1234 -c nginxlsof -Or -p 1234 -p 5678Troubleshooting 7
lsof -i :80 | grep LISTENlsof +L1lsof -nP -iTCP -sTCP:LISTENlsof -i :22 | grep ESTABLISHEDlsof -u tom | wc -lkill $(lsof -t -i :8080)lsof -i :80 -r 5Command Examples
Disk full but du finds nothing
lsof +L1+L1 lists files that have been deleted but are still open in some process. A file you rm-ed whose space never came back is exactly this: a live handle is still pinning the blocks until that process or the machine restarts.
Output
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1420 www 12w REG 254,1 4823445760 1234 /var/log/nginx/access.log (deleted)
See which files under a directory are open
lsof +D /var/log/+D walks the whole directory tree, which is slower but complete; +d only inspects the top level. When a delete or move reports "device or resource busy", this command names the process holding it.
List all listening TCP sockets, fastest form
lsof -nP -iTCP -sTCP:LISTEN-n skips name resolution and -P prints numeric ports, and together with a state filter this is the cheapest form of lsof. On a machine with many sockets the raw table is very wide, so pipe it through awk and keep only the columns you need.
Output
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1420 www 6u IPv4 265781 0t0 TCP *:80 (LISTEN) node 3120 tom 18u IPv4 265781 0t0 TCP *:3000 (LISTEN)
Common Pitfalls
- lsof output is enormous; always scope it with -i, -p, -u or +D, or pipe it through a filter.
- Seeing other users' processes requires root; a normal user only sees their own.
- When deletion fails with "device or resource busy", do not force it — find the holder with lsof first; a forced delete still will not free the space.
- lsof +D recurses the whole directory and is very slow on large trees; prefer lsof | grep there.
- For network connection work prefer ss, which reads kernel netlink and is orders of magnitude faster.
Tips
- lsof needs root to see all users' files; ordinary users see only their own.
- For port conflicts, first find the PID with lsof -i :port, then kill it or change config.
- When the disk is full but no large file shows, use lsof +L1 to find deleted-but-open files.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us