Using lsof to find who is using a file or socket
lsof
stands for List Open Files. It can help us find which process is using a file at a given point in time. The reason lsof
is so useful in Unix/Linux systems is that sockets
and devices
are treated the same way as files (Pretty much everything is considered a file in Unix/Linux).
Running lsof
without any arguments will list all open files in the system. If you have a lot of processes working with a lot of files, prepare to wait. The output looks somethins like this:
1
2
3
4
5
6
7
$ sudo lsof
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,1 4096 2 /
systemd 1 root rtd DIR 253,1 4096 2 /
systemd 1 root txt REG 253,1 1577264 5374284 /lib/systemd/systemd
systemd 1 root mem REG 253,1 18976 5375835 /lib/x86_64-linux-gnu/libuuid.so.1.3.0
...