Using lsof to find who is using a file or socket
lsof stands for List Open Files. It can help us find which process is using a file at a given point in time. The reason lsof is so useful in Unix/Linux systems is that sockets and devices are treated the same way as files (Pretty much everything is considered a file in Unix/Linux).
Running lsof without any arguments will list all open files in the system. If you have a lot of processes working with a lot of files, prepare to wait. The output looks somethins like this:
1
2
3
4
5
6
7
$ sudo lsof
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,1 4096 2 /
systemd 1 root rtd DIR 253,1 4096 2 /
systemd 1 root txt REG 253,1 1577264 5374284 /lib/systemd/systemd
systemd 1 root mem REG 253,1 18976 5375835 /lib/x86_64-linux-gnu/libuuid.so.1.3.0
...