Identity

Property	Value
Binary	`lsof`
Config	No persistent config — invoked directly
Logs	No persistent logs — output to terminal
Type	CLI tool
Install	`apt install lsof` / `dnf install lsof`

Key Operations

Task	Command
All open files on the system	`lsof`
Open files by a specific user	`lsof -u username`
Open files for a specific PID	`lsof -p 1234`
All files open under a directory (recursive)	`lsof +D /var/log`
All network connections	`lsof -i`
Listening TCP/UDP ports only	`lsof -i -sTCP:LISTEN`
What has port 80 open	`lsof -i :80`
Specific protocol connections	`lsof -i tcp`
Connections to a specific host	`lsof -i @10.0.0.1`
Deleted files still held open by a process	`lsof +L1`
Files open by process name	`lsof -c nginx`
Exclude a user (NOT operator)	`lsof -u ^root`
Repeat output every second	`lsof -r 1 -i :80`
Show file descriptor numbers	`lsof -d 1-10`

Symptom	Cause	Fix
Missing files for other users' processes	Not running as root; lsof only shows current user's files without it	Run with `sudo` for complete output
`WARNING: can't stat() fuse.gvfsd-fuse` messages	FUSE or network filesystems that don't support stat	Suppress with `-w`; the warnings are noise, not errors
Very slow on large systems	lsof is single-threaded and walks `/proc` serially	Add `-n` (skip hostname resolution) and `-P` (skip port-name resolution) to speed it up significantly
`lsof: command not found`	Package not installed	`apt install lsof` / `dnf install lsof`
`+D /path` takes very long	Recursively walks every subdirectory	Use `-D /path` for non-recursive, or narrow the path
Port shows as in use but nothing obvious	Deleted socket file or TIME_WAIT state	Check with `lsof +L1` for deleted descriptors; `ss -tnp` to see TIME_WAIT sockets
NFS-mounted file shows no process	NFS file locking happens on the server, not reported locally	Check NFS server with `lsof` there; locally see `nfsstat`

Root required for complete output: without root, lsof only lists open files belonging to the current user. On multi-user systems or when diagnosing daemon processes, always use sudo. The output is silently incomplete otherwise.
lsof +L1 solves "disk full but df shows space": when a large file is deleted while a process still holds an open descriptor, the disk space is not reclaimed until the process closes or exits. lsof +L1 lists all file descriptors with a link count below 1 — these are the deleted-but-still-open files. Truncate the file via /proc/<PID>/fd/<FD> or restart the process to reclaim space immediately.
-n and -P are essential for performance: by default, lsof resolves every IP address to a hostname and every port to a service name via DNS and /etc/services. On systems with many open sockets, this adds seconds. -n skips hostname resolution; -P skips port-to-name resolution. Use both when running on busy servers.
Combining filters with NOT (^): lsof allows combining -u, -p, and -c filters. Prefix with ^ to negate: -u ^root excludes root's files. Multiple positive terms are OR'd by default; add -a to AND them.
lsof is single-threaded and slow on large /proc trees: on systems with thousands of open file descriptors, a full lsof run can take 5-10 seconds. Scope queries as narrowly as possible (-p, -u, or -i :port) rather than running a system-wide dump.

See references/ for: