lsof Cheatsheet - Linux Process & Port Diagnostics Reference
Occupied ports, locked files, a full disk with no large file in sight — all three share one question: which process holds this resource. The sheet is organised along four axes: by process to expand a known PID into its open files and sockets, by port to go the other direction, by file to find its holders, and by type for pipes and memory maps. The least appreciated entry is +L1 under troubleshooting: a deleted file that is still open keeps consuming disk, df will never show it, and only lsof +L1 finds the process holding the dead inode. The division of labour is worth stating — ss and netstat are faster but network-only, fuser can kill directly with -k but gives no connection detail, and /proc is ground truth only if you assemble it yourself. Reach for it when an application reports Address already in use, a log file cannot be written, or umount reports device busy. Budget for permissions: without root you see only your own descriptors, and half a process table is worse than none because it invites false conclusions.
By Process 6
lsof -p 1234lsof -c nginxlsof -c /^nginx/lsof -u tomlsof -u ^rootlsof -p 1234,5678By Port 6
lsof -i :80lsof -i :8080 -i :8443lsof -i tcp:80lsof -i udp:53lsof -i @192.168.1.1:80lsof -i :1-1024By File 4
lsof /var/log/sysloglsof +D /var/log/lsof +d /var/log/lsof /dev/sda1Network 8
lsof -ilsof -i -nlsof -i -Plsof -i -n -Plsof -i tcp@192.168.1.1:22lsof -i -sTCP:ESTABLISHEDlsof -i 4 -P -nlsof -i 6 -P -nBy Type / Format 4
lsof -tlsof -F pfclsof -a -p 1234 -c nginxlsof -Or -p 1234 -p 5678Troubleshooting 7
lsof -i :80 | grep LISTENlsof +L1lsof -nP -iTCP -sTCP:LISTENlsof -i :22 | grep ESTABLISHEDlsof -u tom | wc -lkill $(lsof -t -i :8080)lsof -i :80 -r 5Command Examples
Disk full but du finds nothing
lsof +L1+L1 列出已删除但仍被进程打开的文件。文件被 rm 了但空间没释放，就是因为还有进程持有它。重启对应进程或重启机器才回收。
Output
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1420 www 12w REG 254,1 4823445760 1234 /var/log/nginx/access.log (deleted)
See which files under a directory are open
lsof +D /var/log/+D 递归整个目录，较慢但完整；只想看当前层用 +d。删除或移动文件报 "device or resource busy" 时，这条能直接定位占用进程。
List all listening TCP sockets, fastest form
lsof -nP -iTCP -sTCP:LISTEN-n 不解析域名、-P 显示数字端口，配合状态过滤是 lsof 最快的形式。ls 目录量大时输出会很宽，加 | awk 精简列。
Output
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1420 www 6u IPv4 265781 0t0 TCP *:80 (LISTEN) node 3120 tom 18u IPv4 265781 0t0 TCP *:3000 (LISTEN)
Common Pitfalls
- lsof output is enormous; always scope it with -i, -p, -u or +D, or pipe it through a filter.
- Seeing other users' processes requires root; a normal user only sees their own.
- When deletion fails with "device or resource busy", do not force it — find the holder with lsof first; a forced delete still will not free the space.
- lsof +D recurses the whole directory and is very slow on large trees; prefer lsof | grep there.
- For network connection work prefer ss, which reads kernel netlink and is orders of magnitude faster.
Tips
- lsof needs root to see all users' files; ordinary users see only their own.
- For port conflicts, first find the PID with lsof -i :port, then kill it or change config.
- When the disk is full but no large file shows, use lsof +L1 to find deleted-but-open files.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us