What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Universal configuration monitoring and system of record for IT.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:



May 19, 2015 - A Look At The New Commandlinefu
I've put together a short writeup on what kind of newness you can expect from the next iteration of clfu. Check it out here.
March 2, 2015 - New Management
I'm Jon, I'll be maintaining and improving clfu. Thanks to David for building such a great resource!

Top Tags





Commands tagged lsof from sorted by
Terminal - Commands tagged lsof - 35 results
F=bigdata.xz; lsof -o0 -o -Fo $F | awk -Ft -v s=$(stat -c %s $F) '/^o/{printf("%d%%\n", 100*$2/s)}'
2015-09-19 22:22:43
User: flatcap
Functions: awk stat

Imagine you've started a long-running process that involves piping data,

but you forgot to add the progress-bar option to a command.


xz -dc bigdata.xz | complicated-processing-program > summary


This command uses lsof to see how much data xz has read from the file.

lsof -o0 -o -Fo FILENAME

Display offsets (-o), in decimal (-o0), in parseable form (-Fo)

This will output something like:






Process id (p), File Descriptor (f), Offset (o)


We stat the file to get its size

stat -c %s FILENAME


Then we plug the values into awk.

Split the line at the letter t: -Ft

Define a variable for the file's size: -s=$(stat...)

Only work on the offset line: /^o/


Note this command was tested using the Linux version of lsof.

Because it uses lsof's batch option (-F) it may be portable.


Thanks to @unhammer for the brilliant idea.

f=bigdata.xz; calc "round($(lsof -o0 -o "$f"|awk '{o=substr($7,3)}END{print o}')/$(stat -c %s "$f")*100)"
2015-09-19 18:27:12
User: unhammer

Say you're started "xzcat bigdata.xz | complicated-processing-program >summary" an hour ago, and you of course forgot to enable progress output (you could've just put "awk 'NR%1000==0{print NR>"/dev/stderr"}{print}'" in the pipeline but it's too late for that now). But you really want some idea of how far along your program is. Then you can run the above command to see how many % along xzcat is in reading the file.

Note that this is for the GNU/Linux version of lsof; the one found on e.g. Darwin has slightly different output so the awk part may need some tweaks.

lsof -i -n -P | grep -e "$(ps aux | grep node | grep -v grep | awk -F' ' '{print $2}' | xargs | awk -F' ' '{str = $1; for(i = 2; i < NF; i++) {str = str "\\|" $i} print str}')"
2015-02-14 23:24:00
User: hochmeister
Functions: grep

us lsof, grep for any pid matching a given name such as "node".

lsof|gawk '$4~/txt/{next};/REG.*\(deleted\)$/{printf ">/proc/%s/fd/%d\n", $2,$4}'
2014-03-11 10:40:32
User: wejn
Functions: gawk
Tags: awk lsof gawk

While the posted solution works, I'm a bit uneasy about the "%d" part. This would be hyper-correct approach:

lsof|gawk '$4~/txt/{next};/REG.*\(deleted\)$/{sub(/.$/,"",$4);printf ">/proc/%s/fd/%s\n", $2,$4}'

Oh, and you gotta pipe the result to sh if you want it to actually trim the files. ;)

Btw, this approach also removes false negatives (OP's command skips any deleted files with "txt" in their name).

sudo lsof -p `sudo ps aux | grep -i neo4j | grep -v grep | awk '{ print $2 }'`
2013-06-02 10:15:30
User: andycunn
Functions: awk grep ps sudo

Inner "ps...grep..." command searches for a process matching the specified .

"lsof -p lists all file descriptors owned by . Includes open files, sockets, devices, etc...

lsof -i -n | grep ESTABLISHED
2013-04-03 09:14:09
User: techie
Functions: grep

Fast and easy way to find all established tcp connections without using the netstat command.

watch "lsof -i -P |grep ESTABLISHED |awk '{printf \"%15.15s \\t%s\\n\", \$1, \$9}'"
2013-04-03 02:04:11
User: skarfacegc
Functions: watch

Shows which applications are making connections, and the addresses they're connecting to. Refreshes every 2 seconds (watch's default). Test on OSX, should work anywhere watch and lsof work.

lsof -ni TCP
2013-03-20 22:51:16
User: tsener
Tags: lsof

also could specify port number:

lsof -ni TCP:80

lsof -i -P +c 0 +M | grep -i "$1"
watch -d=c -n3 'lsof -itcp -iudp -c php'
2013-03-14 01:24:50
User: AskApache
Functions: watch
Tags: lsof PHP watch

Shows files and processes of the command php

lsof +c 15 | awk '{print $1}' | sort | uniq -c | sort -rn | head
lsof -Pi | grep LISTEN
2011-10-03 12:50:18
User: 5partan
Functions: grep

This option is much faster, as it checks only network nodes.

lsof -i
2011-10-03 02:06:30
User: shsingh

This option selects the listing of all Internet and x.25 (HP-UX) network files.

netstat -plntu
netstat -plnt
2011-09-30 19:56:32
User: DopeGhoti
Functions: netstat

While `lsof` will work, why not use the tool designed explicitly for this job?

(If not run as root, you will only see the names of PID you own)

lsof -Pn | grep LISTEN
lsof +D <dirname>
2011-09-18 00:01:25
User: ztank1013
Tags: lsof umount

It may be helpful in case you need to umount a directory and some process is preventing you to do so keeping the folder busy. The lsof may process the +D option slowly and may require a significant amount of memory because it will descend the full dir tree. On the other hand it will neither follow symlinks nor other file systems.

watch -n 1 "/usr/sbin/lsof -p PID |awk '/TCP/{split(\$8,A,\":\"); split(A[2],B,\">\") ; split(B[1],C,\"-\"); print A[1],C[1],B[2], \$9}' | sort | uniq -c"
2011-08-12 19:16:38
User: ideivid
Functions: watch

Maybe this will help you to monitor your load balancers or reverse proxies if you happen to use them. This is useful to discover TIME OUTS and this will let you know if one or more of your application servers is not connected by checking.

lsof -nPi | txt2html > ~/lsof.html | gnome-open lsof.html
2011-07-28 21:59:07
User: hippie
Tags: bash lsof

In addition to generating the current connections, it also opens then in your default browser on gnome.

lsof -nPi | txt2html > ~/lsof.html
2011-07-28 14:01:21
User: zlemini
Tags: perl cpan lsof

The output of lsof is piped to txt2html which converts it to html.

# Perl module HTML::TextToHTML needed

lsof -i :22
lsof | awk '/*:https?/{print $2}' | sort -u
2011-02-04 01:37:17
User: sugitaro
Functions: awk sort
Tags: sort awk lsof

% lsof -v

lsof version information:

revision: 4.78

lsof -nP -c COMMAND | egrep -o '(TCP|UDP).*$' | sort -u
2011-01-25 12:04:13
User: forcefsck
Functions: egrep sort
Tags: egrep lsof udp tcp

Where COMMAND is the process(es) name. I prefer to get all states but you may add ESTABLISHED in the grep regex.

lsof -c apache2 | egrep -o 'TCP.*ESTABLISHED.*$'

-nP flags are optional and UDP is irrelevant for established connections

Similar but using the process id:

lsof -nP -p PID | egrep -o '(TCP|UDP).*$'
lsof /folder
2010-09-06 05:10:06
User: dotanmazor
Tags: lsof umount

Instead of using force un-mounting, it's better to find the processes that currently use the relevant folder.

Taken from:


lsof /dev/snd/pcm*p /dev/dsp | awk ' { print $2 }' | xargs kill
2010-07-23 20:24:16
User: alustenberg
Functions: awk xargs

for when a program is hogging the sound output. finds, and kills. add -9 to the end for wedged processes. add in 'grep ^program' after lsof to filter.