Skip to content


Two command output

lsof -i :80 | tee /dev/stderr | wc -l

This will kill all ssh connections from a given host it does give some errors but it does work

lsof -i tcp:22 | grep | awk "{print $2}" |xargs kill

Keep a copy of the raw Youtube FLV,MP4,etc stored in /tmp/

lsof -n -P \
    |grep FlashXX \
    |awk '{ print "/proc/" $2 "/fd/" substr($4, 1, length($4)-1) }' \
    |while read f;do newname=$(exiftool -FileModifyDate -FileType -t -d %Y%m%d%H%M%S $f \
    |cut -f2|tr '\n' '.' \
    |sed 's/\.$//');echo "$f -> $newname";cp $f ~/Vids/$newname;done

PID list by httpd listen port

lsof | awk '/*:https?/{print $2}' | sort -u

Watch Network Service Activity in Real-time

lsof -i
lsof -i tcp:80
lsof -i udp:80
lsof -i :80

Check open ports (both ipv4 and ipv6)

lsof -Pi | grep LISTEN

Show apps that use internet connection at the moment.

lsof -P -i -n | cut -f 1 -d " "| uniq | tail -n +2

Show the processes that use old libs and need a restart

lsof | grep 'DEL.*lib' | cut -f 1 -d ' ' | sort -u

Lists all listening ports together with the PID of the associated process

lsof -Pan -i tcp -i udp

List files opened by a PID

lsof -p 15857

List .log files open by a pid

lsof -p 1234 | grep -E "\.log$" | awk '{print $NF}'

View details of network activity, malicious or otherwise within a port range.

lsof -i :555-7000

List processes with established tcp connections (without netstat)

lsof -i -n | grep ESTABLISHED

List all files opened by a particular command

lsof -c bash

Find size in kilobyte of files that are deleted but still in use and therefore consumes diskspace

lsof -ns | grep REG | grep deleted | awk '{s+=$7/1024} END {print s}'

List processes playing sound

lsof | grep pcm

Show top running processes by the number of open filehandles they have

lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head

Find listening ports by pid

lsof -nP +p 24073 | grep -i listen | awk '{print $1,$2,$7,$8,$9}'

Monitoring file handles used by a particular process

lsof -c <process name> -r

Show what a given user has open using lsof

lsof -u wuseman

List pr. command in megabytes sum of deleted files that are still in use and therefore consumes diskspace

lsof -ns \
    |grep REG \
    |grep deleted \
    |awk '{a[$1]+=$7;}END{for(i in a){printf("%s %.2f MB\n", i, a[i]/1048576);}}'

List all active access_logs for currently running Apache or Lighttpd process

lsof -p $(netstat -ltpn|awk '$4 ~ /:80$/ {print substr($7,1,index($7,"/")-1)}')| awk '$9 ~ /access.log$/ {print $9| "sort -u"}'

The program listening on port 8080 through IPv6

lsof -Pnl +M -i6:8080

Keep track of diff progress

lsof -c diff -o -r1 | grep $file

find out which directories in /home have the most files currently open

lsof \
|awk ' {if ( $0 ~ /home/) print substr($0, index($0,"/home") ) }' \
|cut -d / -f 1-4\
|uniq -c \
|sort -bgr

Which processes are listening on a specific port (e.g. port 80)

lsof -iTCP:80 -sTCP:LISTEN
lsof +L1

Show the working directories of running processes

lsof -bw -d cwd -a -c java

List all the files that have been deleted while they were still open.

lsof | egrep "^COMMAND|deleted"

Top 15 processes with the largest number of open files

lsof +c 15 | awk '{print $1}' | sort | uniq -c | sort -rn | head

Find all open files by named process

lsof -c $processname | egrep 'w.+REG' | awk '{print $9}' | sort | uniq

Find out which process uses an old lib and needs a restart after a system update

lsof | grep 'DEL.*lib' | sort -k1,1 -u

Discovering all open files/dirs underneath a directory

lsof +D /tmp

Show a listing of open mailbox files (or whatever you want to modify it to show)

lsof | grep "/var/spool/mail/"

Check to see what is running on a specific port number

lsof -iTCP:8080 -sTCP:LISTEN

List open file descriptor count by PID

lsof | cut -f 1 -d ' ' | uniq -c | sort -rn | head -n 10
lsof -a -d 1-99 -Fn / | grep ^n | cut -b2- | sort | uniq -c | sort -n

Check which files are opened by Firefox then sort by largest size.

lsof -p $(pidof firefox) | awk '/.mozilla/ { s = int($7/(2^20)); if(s>0) print (s)" MB  "$9 | "sort -rn" }'

Truncate deleted files from lsof

lsof \
    |grep -i deleted \
    |grep REG \
    |grep -v txt \
    |ruby -r 'pp' -e 'STDIN.each do |v| a =  v.split(/ +/); puts `:> /proc/#{a[1]}/fd/#{a[3].chop}`; end'

Find the delete file ,which is in use

lsof -n |grep delete

Display IP addresses Pidgin IM Client is connected to

lsof -p `pidof pidgin` \
    |awk '{ print $9 }' \
    |egrep `hostname`  \
    |grep -o ">[^:]\+:" ┬▒
    |tr -d ":>" \
    | while read line; do 
    host $line; 

View internet connection activity in a browser

lsof -nPi \
    |txt2html  > ~/lsof.html \
    |google-chrome-stable ~/lsof.html

Show 10 Largest Open Files

lsof \
    |awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' \
    |sort -n -u \
lsof -c cmus \
    |awk '/\.mp3/ {print $9}'

  • Comments are closed on this article!

Last update: December 4, 2022 19:31:07