Linux find open files by user

How to Find Out Who is Using a File in Linux

In this article, we will explain how to find out who is using a particular file in Linux. This will help you know the system user or process that is using an open file.

We can use the lsof command to know if someone is using a file, and if they are, who. It reads kernel memory in its search for open files and helps you list all open files. In this case, an open file may be a regular file, a directory, a block special file, a character special file, a stream, a network file and many others – because in Linux everything is a file.

Lsof is used on a file system to identify who is using any files on that file system. You can run lsof command on Linux filesystem and the output identifies the owner and process information for processes using the file as shown in the following output.

$ lsof /dev/null 

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1480 tecmint 0r CHR 1,3 0t0 6 /dev/null sh 1501 tecmint 0r CHR 1,3 0t0 6 /dev/null sh 1501 tecmint 1w CHR 1,3 0t0 6 /dev/null dbus-daem 1530 tecmint 0u CHR 1,3 0t0 6 /dev/null xfce4-ses 1603 tecmint 0r CHR 1,3 0t0 6 /dev/null xfce4-ses 1603 tecmint 1w CHR 1,3 0t0 6 /dev/null at-spi-bu 1604 tecmint 0r CHR 1,3 0t0 6 /dev/null dbus-daem 1609 tecmint 0u CHR 1,3 0t0 6 /dev/null at-spi2-r 1611 tecmint 0u CHR 1,3 0t0 6 /dev/null xfconfd 1615 tecmint 0u CHR 1,3 0t0 6 /dev/null xfwm4 1624 tecmint 0r CHR 1,3 0t0 6 /dev/null xfwm4 1624 tecmint 1w CHR 1,3 0t0 6 /dev/null xfce4-pan 1628 tecmint 0r CHR 1,3 0t0 6 /dev/null xfce4-pan 1628 tecmint 1w CHR 1,3 0t0 6 /dev/null Thunar 1630 tecmint 0r CHR 1,3 0t0 6 /dev/null Thunar 1630 tecmint 1w CHR 1,3 0t0 6 /dev/null xfdesktop 1632 tecmint 0r CHR 1,3 0t0 6 /dev/null xfdesktop 1632 tecmint 1w CHR 1,3 0t0 6 /dev/null .

To list user specific opened files, run the following command replace tecmint with the actual user name.

$ lsof -u tecmint 

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1480 tecmint cwd DIR 8,3 4096 2 / systemd 1480 tecmint rtd DIR 8,3 4096 2 / systemd 1480 tecmint txt REG 8,3 1595792 3147496 /lib/systemd/systemd systemd 1480 tecmint mem REG 8,3 1700792 3150525 /lib/x86_64-linux-gnu/libm-2.27.so systemd 1480 tecmint mem REG 8,3 121016 3146329 /lib/x86_64-linux-gnu/libudev.so.1.6.9 systemd 1480 tecmint mem REG 8,3 84032 3150503 /lib/x86_64-linux-gnu/libgpg-error.so.0.22.0 systemd 1480 tecmint mem REG 8,3 43304 3150514 /lib/x86_64-linux-gnu/libjson-c.so.3.0.1 systemd 1480 tecmint mem REG 8,3 34872 2497970 /usr/lib/x86_64-linux-gnu/libargon2.so.0 systemd 1480 tecmint mem REG 8,3 432640 3150484 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1 systemd 1480 tecmint mem REG 8,3 18680 3150450 /lib/x86_64-linux-gnu/libattr.so.1.1.0 systemd 1480 tecmint mem REG 8,3 18712 3150465 /lib/x86_64-linux-gnu/libcap-ng.so.0.0.0 systemd 1480 tecmint mem REG 8,3 27112 3150489 /lib/x86_64-linux-gnu/libuuid.so.1.3.0 systemd 1480 tecmint mem REG 8,3 14560 3150485 /lib/x86_64-linux-gnu/libdl-2.27.so .

Another important use of lsof is to find out the process listening on a specific port. For example identify the process listening on port 80 using the following command.

$ sudo lsof -i TCP:80 

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 903 root 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1320 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1481 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1482 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1493 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 1763 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 2027 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 2029 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 2044 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 3199 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN) httpd 3201 apache 4u IPv6 20222 0t0 TCP *:http (LISTEN)

Note: Since lsof reads kernel memory in its search for open files, rapid changes in kernel memory may result into unpredictable outputs. This is one of the major downsides of using lsof command.

For more information, look at the lsof man page:

That’s all! In this article, we have explained how to know who is using a particular file in Linux. We have shown how to identify the owner and process information for processes using an open file. Use the feedback form below to reach us for any questions or comments.

Источник

7 Examples of lsof command in Linux

I guess at some point in time you have wondered if there is a way to show opened files by a process or a user. The good thing is that the answer to that question is lsof command.

You probably already know that ls command is short for ‘list’. lsof stands for ‘List Open Files’. And that’s exactly what it does, listing open files by processes, users, and process IDs.

Let me show you some of the most common usages of the lsof command.

lsof command examples

If you use lsof command without any options and arguments, it will list all opened files by all the processes in the system.

The output should be like this:

COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd DIR 252,1 4096 2 / systemd 1 root rtd DIR 252,1 4096 2 / systemd 1 root txt REG 252,1 1595792 17384 /lib/systemd/systemd systemd 1 root mem REG 252,1 1700792 2077 /lib/x86_64-linux-gnu/libm-2.27.so

The output is mostly self-explanatory but you may still wonder about FD and TYPE columns.

FD means file descriptor. Some of the common values for FD are:

• cwd – Current Working Directory
• txt – Text files
• mem – Memory mapped file
• mmap – Memory mapped device
• NUMBER – The actual file descriptor. It also has information about which file permission it is opened in.

TYPE is a no-brainer. It specifies the file type. Here are some examples:

• REG – Regular file
• DIR – Directory
• CHR – Character special file
• FIFO – First In First Out

Trust me. You wouldn’t want to run the lsof command without any arguments.

Why do I say this? Because it will start flooding your screen with thousands of results.

If I run the lsof command on an Ubuntu server and count the number of lines with wc command, here’s the result.

Yes! That’s right. There are over eleven thousand files opened by various processes in the system.

Don’t worry. lsof command is very helpful in debugging because you can see what processes open what files and which file is opened by which process.

If you are not logged in as root, the output of lsof command would be very limited. It is a good idea to use sudo if you are logged in as a non-root user.

1. List all the processes that have opened a certain file

This is simple. You just need to specify the path to the file.

2. List all the files opened by user

This comes handy in a multi-user environment. You can list all the files opened by a certain user in the following manner:

You can also specify more than one user like this:

3. List all opened files in a directory

If you are wondering which of the files have been opened in a certain directory, you can use lsof command with +D option.

The search is recursive. So it will list all the opened files in the mentioned directory and all of its sub-directories.

4. List all opened files by a process

You need to know the process id (pid) in this case. If you know the process id, you can use the -p option of the lsof command to find the files opened by it.

You can specify multiple process ids as well.

5. List all files opened by a command

This is specially helpful in debugging. Suppose you want to see what files are used by http daemon, you just need to specify the command name (httpd in our example).

6. Find files opened by a user and a command or a process

You can combine options like user and command and a process using the –a option. Think of it as the AND operator. This gives you an additional filter while trying to narrow down on your search.

lsof -a -u user_name -c command_name

7. List network connections and ports with lsof command

You can file all kinds of open ports with the -i option:

The output may look like this:

lsof -i COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 920 root 3u IPv4 20507 0t0 TCP *:ssh (LISTEN) sshd 920 root 4u IPv6 20535 0t0 TCP *:ssh (LISTEN) docker-pr 1163 root 4u IPv6 21687 0t0 TCP *:https (LISTEN) docker-pr 1175 root 4u IPv6 21717 0t0 TCP *:http (LISTEN) sshd 7528 root 3u IPv4 39506588 0t0 TCP testing:ssh->212.91.91.19:58904 (ESTABLISHED) systemd-r 10993 systemd-resolve 12u IPv4 20901990 0t0 UDP localhost:domain systemd-r 10993 systemd-resolve 13u IPv4 20901991 0t0 TCP localhost:domain (LISTEN)

You can also specify the network connection type. For example, to list all the opened TCP ports, you can use:

To find which process is using a specific port, you can provide the port number:

Bonus Tip: Using the negation operator with lsof

You can use the negation operator to exclude a user or process while using lsof command.

For example, if you want to list all the files opened by a user other than root, use it in this manner:

lsof command becomes even more useful when you use it with the grep command.

I hope you learned something new from this article. If you have questions or suggestions, please leave a comment below.

Источник

Use of “lsof” Command to Find Open Files

“lsof” stands for List Open Files. It is a Linux utility for listing down all the open files of a system. This command can be combined with different parameters to modify its output as desired. You can see the details of all of its parameters and flags by seeing the help manual of the “lsof” command.

In today’s article, you will be able to learn the correct usage of the “lsof” command for finding all the open files in Linux Mint 20.

Use of “lsof” Command to Find the Open Files in Linux Mint 20

To learn the correct usage of the “lsof” command and use it to find the open files in Linux Mint 20, you can take a look at all the examples that have been shared below.

Example 1: List All the Open Files in Linux Mint 20
To list down all the open files in Linux Mint 20, you will have to execute the following command in the terminal:

This command will display a list of all the currently opened files on your Linux Mint 20 system, as shown in the image below:

Example 2: List All the Open Files Belonging to a Particular Directory in Linux Mint 20
You can also list down all the open files belonging to a particular directory in Linux Mint 20 by specifying the name of that directory with the “lsof” command in the following manner:

Here, you have to replace the directorypath with the actual path of the directory whose open files you want to list down. For example, we have replaced it with “/var/log/”.

This command will display a list of all the open files that belong to the “/var/log/” directory, as shown in the image below:

Example 3: List All the Open Files Belonging to a Particular User in Linux Mint 20
If you want to list down all the open files belonging to a particular user in Linux Mint 20, then you can do so by executing the “lsof” command in the following manner:

Here, you have to replace the username with the name of the user whose open files you want to list down. For example, we have replaced it with “kbuzdar”.

This command will display a list of all the open files that belong to the specified user, as shown in the image below:

Example 4: List All the Open Files Belonging to a Particular Internet Protocol in Linux Mint 20
You can also try to list down all the open files belonging to a particular Internet protocol in Linux Mint 20 by executing the “lsof” command in the following manner:

You can also replace “6” with “4” if you want to list down all the open files belonging to IPv4.

This command will display a list of all the open files belonging to the IPv6 protocol, as shown in the image below:

Example 5: List All the Open Files Belonging to a Particular File System in Linux Mint 20
If you want to list down all the open files belonging to a particular file system in Linux Mint 20, then you can do so by tweaking the “lsof” command in the following manner:

Here, you can replace “/proc” with any other file system of your choice as well.

This command will display a list of all the open files belonging to the “/proc” file system, as shown in the image below:

Conclusion

By going through all the examples that have been shown to you in this article, you will be able to learn the correct usage of the “lsof” command for finding all the open files in Linux Mint 20.

About the author

Karim Buzdar

Karim Buzdar holds a degree in telecommunication engineering and holds several sysadmin certifications. As an IT engineer and technical author, he writes for various web sites. He blogs at LinuxWays.

Источник