Linux: Show Opened Files, lsof
You can use the command lsof to list all files opened by processes.
In unix/linux, “everything” is a file. Devices (such as all USB device) are files, network sockets are files, directory is a file.
Here's some of the commonly used options.
lsof -h- Display a short help documentation.
lsof fpath- Show all that has opened file at fpath
lsof -i- List files associated with internet (e.g. browser process)
lsof -u userName- Show all with login/uid userName
lsof -p pid-
By pid.
123,^456 lsof +d dir- By dir path dir
lsof +D dir- By dir path dir, also show all dir's children
lsof -c cmd- Show files opened by command whose name starts with cmd
FD means “file descriptor”. Common FD code are:
- cwd
- Current working directory
- ltx
- Shared library text (code and data)
- m86
- DOS Merge mapped file
- mem
- Memory-mapped file
- mmap
- Memory-mapped device
- pd
- Parent directory
- rtd
- Root directory
- txt
- Program text (code and data)
- number
- File descriptor. 0 is stdin, 1 is stdout, 2 is stderr. A letter {r,w,u} after it means mode. “u” = read and write. “r” = read. “w” = write.
see man lsof for complete list and description.
TYPE → is the file type. Common types are:
- REG
- Regular file
- LINK
- Symbolic link file
- DIR
- Directory
- BLK
- Block special file (device file)
- CHR
- Character special file (device file)
- FIFO
- FIFO special file
- PIPE
- Pipes
- PMEM
- /proc memory image file
- IPv4
- IPv4 socket
- IPv6
- Open IPv6 network file - even if its address is IPv4, mapped in an IPv6 address
- inet
- Internet domain socket
- sock
- Socket of unknown domain
- unix
- UNIX domain socket