Commands tagged lsof (40)

  • Show apps that use internet connection at the moment.

    show only the name of the apps that are using internet Show Sample Output


    36
    lsof -P -i -n | cut -f 1 -d " "| uniq | tail -n +2
    edo · 2009-09-19 21:23:54 26
  • Lists all listening ports together with the PID of the associated process

    This command is more portable than it's cousin netstat. It works well on all the BSDs, GNU/Linux, AIX and Mac OS X. You won't find lsof by default on Solaris or HPUX by default, but packages exist around the web for installation, if needed, and the command works as shown. This is the most portable command I can find that lists listening ports and their associated pid. Show Sample Output


    29
    lsof -Pan -i tcp -i udp
    atoponce · 2010-06-07 15:22:44 14
  • List all files opened by a particular command

    List all file opened by a particular command based on it's command name. Show Sample Output


    25
    lsof -c dhcpd
    d4n3sh · 2009-04-17 07:18:38 11
  • Discovering all open files/dirs underneath a directory

    It may be helpful in case you need to umount a directory and some process is preventing you to do so keeping the folder busy. The lsof may process the +D option slowly and may require a significant amount of memory because it will descend the full dir tree. On the other hand it will neither follow symlinks nor other file systems.


    13
    lsof +D <dirname>
    ztank1013 · 2011-09-18 00:01:25 5
  • Check which files are opened by Firefox then sort by largest size.

    Just refining last proposal for this check, showing awk power to make more complex math (instead /1024/1024, 2^20). We don't need declare variable before run lsof, because $(command) returns his output. Also, awk can perform filtering by regexp instead to call grep. I changed the 0.0000xxxx messy output, with a more readable form purging all fractional numbers and files less than 1 MB. Show Sample Output


    10
    lsof -p $(pidof firefox) | awk '/.mozilla/ { s = int($7/(2^20)); if(s>0) print (s)" MB -- "$9 | "sort -rn" }'
    tzk · 2010-01-13 22:45:53 9
  • Show which process is blocking umount (Device or resource is busy)

    Instead of using force un-mounting, it's better to find the processes that currently use the relevant folder. Taken from: http://www.linuxhowtos.org/Tips%20and%20Tricks/findprocesses.htm Show Sample Output


    9
    lsof /folder
    dotanmazor · 2010-09-06 05:10:06 5
  • check open ports (both ipv4 and ipv6)

    While `lsof` will work, why not use the tool designed explicitly for this job? (If not run as root, you will only see the names of PID you own) Show Sample Output


    8
    netstat -plnt
    DopeGhoti · 2011-09-30 19:56:32 6
  • Check how far along (in %) your program is in a file

    Imagine you've started a long-running process that involves piping data, but you forgot to add the progress-bar option to a command. e.g. xz -dc bigdata.xz | complicated-processing-program > summary . This command uses lsof to see how much data xz has read from the file. lsof -o0 -o -Fo FILENAME Display offsets (-o), in decimal (-o0), in parseable form (-Fo) This will output something like: . p12607 f3 o0t45187072 . Process id (p), File Descriptor (f), Offset (o) . We stat the file to get its size stat -c %s FILENAME . Then we plug the values into awk. Split the line at the letter t: -Ft Define a variable for the file's size: -s=$(stat...) Only work on the offset line: /^o/ . Note this command was tested using the Linux version of lsof. Because it uses lsof's batch option (-F) it may be portable. . Thanks to @unhammer for the brilliant idea. Show Sample Output


    7
    F=bigdata.xz; lsof -o0 -o -Fo $F | awk -Ft -v s=$(stat -c %s $F) '/^o/{printf("%d%%\n", 100*$2/s)}'
    flatcap · 2015-09-19 22:22:43 18
  • List files opened by a PID

    Lis all files opened by a particular process id. "PID" Show Sample Output


    6
    lsof -p 15857
    d4n3sh · 2009-04-17 07:16:03 5
  • Check which files are opened by Firefox then sort by largest size.

    Check which files are opened by Firefox then sort by largest size (in MB). You can see all files opened by just replacing grep to "/". Useful if you'd like to debug and check which extensions or files are taking too much memory resources in Firefox. Show Sample Output


    6
    FFPID=$(pidof firefox-bin) && lsof -p $FFPID | awk '{ if($7>0) print ($7/1024/1024)" MB -- "$9; }' | grep ".mozilla" | sort -rn
    josue · 2009-08-16 08:58:22 7
  • determine if tcp port is open


    5
    lsof -i :22
    bucciarati · 2011-03-11 16:48:37 6
  • Show established network connections


    4
    lsof -i | grep -i estab
    P17 · 2009-05-06 17:45:55 16
  • List processes playing sound

    When trying to play a sound you may sometimes get an error saying that your sound card is already used, but not by what process. This will list all processes playing sound, useful to kill processes that you no longer need but that keep using your sound card. Show Sample Output


    4
    lsof | grep pcm
    Miles · 2010-05-16 12:12:01 4
  • check open ports (both ipv4 and ipv6)


    4
    lsof -Pn | grep LISTEN
    pykler · 2011-09-29 18:21:51 11
  • find listening ports by pid

    change 24073 to your pid Show Sample Output


    3
    lsof -nP +p 24073 | grep -i listen | awk '{print $1,$2,$7,$8,$9}'
    icreed · 2009-05-26 20:47:14 5
  • give me back my sound card

    for when a program is hogging the sound output. finds, and kills. add -9 to the end for wedged processes. add in 'grep ^program' after lsof to filter. Show Sample Output


    2
    lsof /dev/snd/pcm*p /dev/dsp | awk ' { print $2 }' | xargs kill
    alustenberg · 2010-07-23 20:24:16 12
  • View internet connection activity in a browser

    The output of lsof is piped to txt2html which converts it to html. # Perl module HTML::TextToHTML needed Show Sample Output


    2
    lsof -nPi | txt2html > ~/lsof.html
    zlemini · 2011-07-28 14:01:21 9
  • Monitor incoming connections of proxies and balancers.

    Maybe this will help you to monitor your load balancers or reverse proxies if you happen to use them. This is useful to discover TIME OUTS and this will let you know if one or more of your application servers is not connected by checking. Show Sample Output


    2
    watch -n 1 "/usr/sbin/lsof -p PID |awk '/TCP/{split(\$8,A,\":\"); split(A[2],B,\">\") ; split(B[1],C,\"-\"); print A[1],C[1],B[2], \$9}' | sort | uniq -c"
    ideivid · 2011-08-12 19:16:38 4
  • Open Port Check

    also could specify port number: lsof -ni TCP:80


    2
    lsof -ni TCP
    tsener · 2013-03-20 22:51:16 8
  • find established tcp connections without using netstat!!

    Fast and easy way to find all established tcp connections without using the netstat command.


    2
    lsof -i -n | grep ESTABLISHED
    techie · 2013-04-03 09:14:09 9
  • Check how far along (in %) your program is in a file

    Say you're started "xzcat bigdata.xz | complicated-processing-program >summary" an hour ago, and you of course forgot to enable progress output (you could've just put "awk 'NR%1000==0{print NR>"/dev/stderr"}{print}'" in the pipeline but it's too late for that now). But you really want some idea of how far along your program is. Then you can run the above command to see how many % along xzcat is in reading the file. Note that this is for the GNU/Linux version of lsof; the one found on e.g. Darwin has slightly different output so the awk part may need some tweaks. Show Sample Output


    2
    f=bigdata.xz; calc "round($(lsof -o0 -o "$f"|awk '{o=substr($7,3)}END{print o}')/$(stat -c %s "$f")*100)"
    unhammer · 2015-09-19 18:27:12 14
  • View internet connection activity in a browser

    In addition to generating the current connections, it also opens then in your default browser on gnome.


    1
    lsof -nPi | txt2html > ~/lsof.html | gnome-open lsof.html
    hippie · 2011-07-28 21:59:07 6
  • check open ports (both ipv4 and ipv6)

    Check open TCP and UDP ports Show Sample Output


    1
    netstat -plntu
    bolthorn0 · 2011-10-01 12:16:38 4
  • Top 15 processes with the largest number of open files

    See the summary. Show Sample Output


    1
    lsof +c 15 | awk '{print $1}' | sort | uniq -c | sort -rn | head
    SEJeff · 2012-05-25 16:31:46 4
  • truncate deleted files from lsof

    While the posted solution works, I'm a bit uneasy about the "%d" part. This would be hyper-correct approach: lsof|gawk '$4~/txt/{next};/REG.*\(deleted\)$/{sub(/.$/,"",$4);printf ">/proc/%s/fd/%s\n", $2,$4}' Oh, and you gotta pipe the result to sh if you want it to actually trim the files. ;) Btw, this approach also removes false negatives (OP's command skips any deleted files with "txt" in their name).


    1
    lsof|gawk '$4~/txt/{next};/REG.*\(deleted\)$/{printf ">/proc/%s/fd/%d\n", $2,$4}'
    wejn · 2014-03-11 10:40:32 13
  •  1 2 > 

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

execute a shell with netcat without -e
Shorter version with proper stderr redirection .

Simple complete system backup excluding files or directories
You can exclude more system folders or individual files which are not necessary for the backup and can be recreated after the restore procedure, like /lost+found, /mnt, /media, /tmp, /usr ... Restoring the above backup procedure is as simple as becoming root and typing: $ tar zxpf backup.tgz -C / You can extract any file or directory out of the backup.tgz file for recovery, for instance, if you have a corrupt or mis-configured fstab file, you could simply issue the command: $ tar zxpf backup.tgz /ect/fstab -C / Other options: v add verbose option to see files processed A far safer solution is to restore the desired files under a different directory, and then compare, move, or update the files to their original locations afterward.

Find files of two different extensions and copy them to a directory

Find and remove core files

zsh suffix to inform you about long command ending
make, find and a lot of other programs can take a lot of time. And can do not. Supppose you write a long, complicated command and wonder if it will be done in 3 seconds or 20 minutes. Just add "R" (without quotes) suffix to it and you can do other things: zsh will inform you when you can see the results. You can replace zenity with other X Window dialogs program.

dont execute command just add it to history as a comment, handy if your command is not "complete" yet

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Check if you work on a virtual/physical machine in Linux
Command used to know if we are working on a virtual or physical machine. This command will use the dmidecode utility to retrieve hardware information of your computer via the BIOS. Run this command as root or with sudo.

Concatenate (join) video files
Use mencoder to concatenate (join) multiple video files together.

Open files in a split windowed Vim
-o acts like :spit. Use -O (capital o) for side-by-side like :vsplit. Use vim -d or vimdiff if you need a diff(1) comparison. To split gnu Screen instead of vim, use ^A S for horizontal, ^A | for vertical.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: