For a more extensive set of examples, documented more fully, see
the 00QUICKSTART file of the lsof distribution.
To list all open files, use:
lsof
To list all open Internet, x.25 (HP-UX), and UNIX domain files,
use:
lsof -i -U
To list all open IPv4 network files in use by the process whose
PID is 1234, use:
lsof -i 4 -a -p 1234
Presuming the UNIX dialect supports IPv6, to list only open IPv6
network files, use:
lsof -i 6
To list all files using any protocol on ports 513, 514, or 515 of
host wonderland.cc.purdue.edu, use:
lsof -i @wonderland.cc.purdue.edu:513-515
To list all files using any protocol on any port of
mace.cc.purdue.edu (cc.purdue.edu is the default domain), use:
lsof -i @mace
To list all open files for login name ``abe'', or user ID 1234,
or process 456, or process 123, or process 789, use:
lsof -p 456,123,789 -u 1234,abe
To list all open files on device /dev/hd4, use:
lsof /dev/hd4
To find the process that has /u/abe/foo open, use:
lsof /u/abe/foo
To send a SIGHUP to the processes that have /u/abe/bar open, use:
kill -HUP `lsof -t /u/abe/bar`
To find any open file, including an open UNIX domain socket file,
with the name /dev/log, use:
lsof /dev/log
To find processes with open files on the NFS file system named
/nfs/mount/point whose server is inaccessible, and presuming your
mount table supplies the device number for /nfs/mount/point, use:
lsof -b /nfs/mount/point
To do the preceding search with warning messages suppressed, use:
lsof -bw /nfs/mount/point
To ignore the device cache file, use:
lsof -Di
To obtain PID and command name field output for each process,
file descriptor, file device number, and file inode number for
each file of each process, use:
lsof -FpcfDi
To list the files at descriptors 1 and 3 of every process running
the lsof command for login ID ``abe'' every 10 seconds, use:
lsof -c lsof -a -d 1 -d 3 -u abe -r10
To list the current working directory of processes running a
command that is exactly four characters long and has an 'o' or
'O' in character three, use this regular expression form of the
-c c option:
lsof -c /^..o.$/i -a -d cwd
To find an IP version 4 socket file by its associated numeric
dot-form address, use:
lsof -i@128.210.15.17
To find an IP version 6 socket file (when the UNIX dialect
supports IPv6) by its associated numeric colon-form address, use:
lsof -i@[0:1:2:3:4:5:6:7]
To find an IP version 6 socket file (when the UNIX dialect
supports IPv6) by an associated numeric colon-form address that
has a run of zeroes in it - e.g., the loop-back address - use:
lsof -i@[::1]
To obtain a repeat mode marker line that contains the current
time, use:
lsof -rm====%T====
To add spaces to the previous marker line, use:
lsof -r "m==== %T ===="
