| lsof | |
| Author: | Victor A. Abell |
| Programming Language: | C |
| Operating System: | Linux, FreeBSD, macOS, Solaris, NetBSD and OpenBSD |
| Platform: | Cross-platform |
| License: | BSD license-compatible[1] |
lsof is a command meaning "list open files", which is used in many Unix-like systems to report a list of all open files and the processes that opened them. This open source utility was developed and supported by Victor A. Abell, the retired Associate Director of the Purdue University Computing Center. It works in and supports several Unix flavors.
A replacement for Linux, , is included in util-linux.[2]
In 1985, Cliff Spencer publishes the command. Its man page says: "ofiles – who has a file open [...] displays the owner and id of any process accessing a specified device". Spencer compiled it for 4.2BSD and ULTRIX.[3] Moreover, in the newsgroup net.unix-wizards, he further remarks:[4]
With all the chatter about dismounting active file systems,I have posted my program to indicate who is usinga particular filesystem, "ofiles" to net.sources.
In 1988, the command ("file status") appears as part of the 4.3BSD-Tahoe release. Its man page says:[5]
fstat identifies open files. A file is considered open if aprocess has it open, if it is the working directory for aprocess, or if it is an active pure text file. If no options are specified, fstat reports on all open files.
In 1989, in comp.sources.unix, Vic Abell publishes ports of the ofiles and fstat commands from 4.3BSD-Tahoe to "DYNIX3.0.1[24] for Sequent Symmetry and Balance, SunOS 4.0 and ULTRIX 2.2".[6] [7] Various people had evolved and ported ofiles over the years. Abell contrasted the commands as follows:
Fstat is similar to the ofiles program which I recently submitted. Likeofiles, fstat identifies open files. It's orientation differs slightlyfrom that of ofiles: ofiles starts with a file name and paws through theproc and user structures to identify the file; fstat reads all the procand user structures, displaying information in all files, optionallyapplying a few filters to the output (including a single file name filter.)In combination with netstat -aA and grep, fstat will identify the processassociated with a network connection, just as will ofiles.
In 1991, Vic Abell publishes lsof version 1.0 to comp.sources.unix. He notes:[8]
Lsof (for LiSt Open Files) lists files opened by processes on selectedUnix systems. It is my answer to those who regularly ask me when I amgoing to make fstat (comp.sources.unix volume 18, number 107) or ofiles(volume 18, number 57) available on SunOS 4.1.1 or the like.Lsof is a complete redesign of the fstat/ofiles series, based on the SunOSvnode model. Thus, it has been tested on AIX 3.1.[357], HP-UX [78].x,NeXTStep 2.[01], Sequent Dynix 3.0.12 and 3.1.2, and Sunos 4.1 and 4.1.1.Using available kernel access methods, such as nlist and kvm_read,lsof reads process table entries, user areas and file pointers to reachthe underlying structures that describe files opened by processes.
In 2018, Vic Abbell publishes lsof version 4.92. The same year, he initiates the transfer of responsibility. He writes:[9]
I will reach 80 years of age later this year and I think it's time for me to end my work on general lsof revision releases.The lsof code is put on Github and maintenance is transferred.[10]
Open files in the system include disk files, named pipes, network sockets and devices opened by all processes. One use for this command is when a disk cannot be unmounted because (unspecified) files are in use. The listing of open files can be consulted (suitably filtered if necessary) to identify the process that is using the files.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsyslogd 350 root 5w VREG 222,5 0 440818 /var/adm/messagessyslogd 350 root 6w VREG 222,5 339098 6248 /var/log/syslogcron 353 root cwd VDIR 222,5 512 254550 /var -- atjobs
To view the port associated with a daemon:
sendmail 31649 root 4u IPv4 521738 TCP *:25 (LISTEN)
From the above one can see that "sendmail" is listening on its standard port of "25".
One can also list Unix Sockets by using lsof -U.
The lsof output describes:
For a complete list of options, see the Lsof(8) Linux manual page.[11]