{"id":35246,"date":"2024-08-31T23:42:53","date_gmt":"2024-08-31T23:42:53","guid":{"rendered":"https:\/\/goodwriterz.com\/site\/?p=35246"},"modified":"2024-08-31T23:42:53","modified_gmt":"2024-08-31T23:42:53","slug":"how-to-use-the-linux-lsof-command","status":"publish","type":"post","link":"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/","title":{"rendered":"How to Use the Linux lsof Command"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_68_1 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >\u062c\u062f\u0648\u0644 \u0627\u0644\u0645\u062d\u062a\u0648\u064a\u0627\u062a<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Key_Takeaways\" title=\"Key Takeaways\">Key Takeaways<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#On_Linux_Everything_Is_a_File\" title=\"On Linux, Everything Is a File\">On Linux, Everything Is a File<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#The_lsof_Command\" title=\"The lsof Command\">The lsof Command<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#The_lsof_Columns\" title=\"The lsof Columns\">The lsof Columns<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#The_FD_Column\" title=\"The FD Column\">The FD Column<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#The_TYPE_Column\" title=\"The TYPE Column\">The TYPE Column<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#See_Processes_That_Have_Opened_a_File\" title=\"See Processes That Have Opened a File\">See Processes That Have Opened a File<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#See_All_Files_Opened_from_a_Directory\" title=\"See All Files Opened from a Directory\">See All Files Opened from a Directory<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#List_Files_Opened_By_a_Process\" title=\"List Files Opened By a Process\">List Files Opened By a Process<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#See_Files_Opened_By_a_User\" title=\"See Files Opened By a User\">See Files Opened By a User<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Excluding_FIles_Opened_by_a_User\" title=\"Excluding FIles Opened by a User\">Excluding FIles Opened by a User<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#List_FIles_Opened_by_a_Process\" title=\"List FIles Opened by a Process\">List FIles Opened by a Process<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Listing_Process_IDs_That_Have_Opened_a_FIle\" title=\"Listing Process IDs That Have Opened a FIle\">Listing Process IDs That Have Opened a FIle<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Use_AND_and_OR_Searches\" title=\"Use AND and OR Searches\">Use AND and OR Searches<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Automatically_Refreshing_The_Display\" title=\"Automatically Refreshing The Display\">Automatically Refreshing The Display<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Displaying_Files_Associated_with_Internet_Connections\" title=\"Displaying Files Associated with Internet Connections\">Displaying Files Associated with Internet Connections<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Displaying_Files_Associated_with_Internet_Connections_by_Process_ID\" title=\"Displaying Files Associated with Internet Connections by Process ID\">Displaying Files Associated with Internet Connections by Process ID<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Displaying_Files_Associated_with_Internet_Connections_and_Commands\" title=\"Displaying Files Associated with Internet Connections and Commands\">Displaying Files Associated with Internet Connections and Commands<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Displaying_Files_Associated_with_Internet_Connections_and_Ports\" title=\"Displaying Files Associated with Internet Connections and Ports\">Displaying Files Associated with Internet Connections and Ports<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Displaying_Files_Associated_with_Internet_Connections_and_Protocols\" title=\"Displaying Files Associated with Internet Connections and Protocols\">Displaying Files Associated with Internet Connections and Protocols<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/#Weve_Only_Scratched_the_Surface\" title=\"We&#8217;ve Only Scratched the Surface\">We&#8217;ve Only Scratched the Surface<\/a><\/li><\/ul><\/nav><\/div>\n<div>\n<section class=\"emaki-custom-block emaki-custom-key-points\">\n<div class=\"emaki-custom key-points\" id=\"custom_block_0\">\n<h3 class=\"title icon i-list\"><span class=\"ez-toc-section\" id=\"Key_Takeaways\"><\/span>Key Takeaways<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"custom_block-content key-points\">\n<ul>\n<li> Linux simplifies handling a wide range of different resources by treating devices that accept or generate byte streams as files. <\/li>\n<li> The lsof command can be used to list open files in the system, including processes and devices treated as files. <\/li>\n<li> lsof can be used to search for files opened by specific processes, directories, users, ports, and protocols, providing detailed information about each file. <\/li>\n<\/ul>\n<\/div><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":0,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":0,\"nbrPlacementsScanned\":0,\"ruleCount\":200,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":240} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":0,\"ruleCount\":200,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":200,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/section>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":0} --><br \/>\n<!-- No winning ad found for zone: below first paragraph! --><\/p>\n<p> If everything in Linux is a file, there has to be more to it than just files on your hard drive. This tutorial will show you how to use <code>lsof<\/code> to see all the other devices and processes that are being handled as files. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":218} --><br \/>\n<!-- No winning ad found for zone: native in content! --><\/p>\n<h2 id=\"on-linux-everything-is-a-file\"><span class=\"ez-toc-section\" id=\"On_Linux_Everything_Is_a_File\"><\/span> On Linux, Everything Is a File <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The oft-quoted phrase that everything in Linux is a file is sort of true. A file is a collection of bytes. When they are being read into a program or sent to a printer, they appear to generate a stream of bytes. When they are being written to, they accept a stream of bytes. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":494} --><\/p>\n<p> Many other system components accept or generate streams of bytes, such as keyboards, socket connections, printers, and communication processes. Because they either accept, generate, or accept and generate byte streams, these devices can be handle\u2014at a very low level\u2014as though they were files. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":801} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":801,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":99,\"nextBlockCount\":200,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1001} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<p> This design concept simplified the implementation of the Unix operating system. It meant that a small set of handlers, tools, and APIs could be created to handle a wide range of different resources. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":101} --><\/p>\n<p> The data and program files that reside on your hard disk are plain old filesystem files. We can use the ls command to list them and find out some details about them. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":268} --><\/p>\n<p> How do we find out about all the other processes and devices that are being treated as though they were files? We use the <code>lsof<\/code> command. This lists the open files in the system. That is, it lists anything that is being handled as though it were a file. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":521} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":521} --><\/p>\n<h2 id=\"the-lsof-command\"><span class=\"ez-toc-section\" id=\"The_lsof_Command\"><\/span> The lsof Command <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> Many of the processes or devices that <code>lsof<\/code> can report on belong to root or were launched by root, so you will need to use the sudo command with <code>lsof<\/code>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":672} --><\/p>\n<p> And because this listing will be very long, we are going to pipe it through less, too. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":760} --><\/p>\n<pre>sudo lsof | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":778} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"lsof in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1018} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> Before the <code>lsof<\/code> output appears GNOME users may see a warning message in the terminal window. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":94} --><\/p>\n<pre><code class=\"hljs xml\">lsof: WARNING: can't stat() fuse.gvfsd-fuse file system \/run\/user\/1000\/gvfs<br \/>Output information may be incomplete.<\/code> <\/pre>\n<p> <code>lsof<\/code> tries to process all mounted filesystems. This warning message is raised because <code>lsof<\/code> has encountered a <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/GVfs\">GNOME Virtual file system<\/a> (GVFS). This is a special case of a <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Filesystem_in_Userspace\">filesystem in user space<\/a> (FUSE). It acts as a bridge between GNOME, its APIs and the kernel. No one\u2014not even root\u2014can access one of these file systems, apart from the owner who mounted it (in this case, GNOME). You can ignore this warning. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":518} --><\/p>\n<p> The output from <code>lsof<\/code> is very wide. The leftmost columns are: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":580} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"the leftmost columns of lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147762_983_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147762_983_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":820} --><\/p>\n<p> The rightmost columns are: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":848} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":848,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":52,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1088} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"the righttmost columns of lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147762_399_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147762_399_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":188} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":188} --><\/p>\n<h2 id=\"the-lsof-columns\"><span class=\"ez-toc-section\" id=\"The_lsof_Columns\"><\/span> The lsof Columns <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> All columns do not apply to every type of open file. It is normal for some of them to be blank. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":285} --><\/p>\n<ul>\n<li> Command: The name of the command associated with the process that opened the file. <\/li>\n<li> PID: Process Identification number of the process that opened the file. <\/li>\n<li> TID: Task (thread) Identification number. A blank column means it is not a task; it is a process. <\/li>\n<li> User: User ID or name of the user to whom the process belongs, or the user ID or login of the person that owns the directory in <code>\/proc<\/code> where <code>lsof<\/code> finds information about the process. <\/li>\n<li> FD: Shows the file descriptor of the file. File descriptors are described below. <\/li>\n<li> Type: type of node associated with the file. Note types are described below. <\/li>\n<li> Device: Contains either the device numbers, separated by commas, for a character special, block special, regular, directory or NFS file, or a kernel reference address that identifies the file. It might also show the base address or device name of a Linux AX.25 socket device. <\/li>\n<li> Size\/Off: Shows the size of the file or the file offset in bytes. <\/li>\n<li> Node: Shows the node number of a local file, or the inode number of an NFS file in the server host, or internet protocol type. It might display STR for a stream or the IRQ or inode number of a Linux AX.25 socket device. <\/li>\n<li> Name: Shows the name of the mount point and file system on which the file resides. <\/li>\n<\/ul>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1534} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":0} --><\/p>\n<h2 id=\"the-fd-column\"><span class=\"ez-toc-section\" id=\"The_FD_Column\"><\/span> The FD Column <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The file descriptor in the FD column can be one of many options; the man page <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/lsof.8.html\">list them all<\/a>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":94} --><\/p>\n<p> The FD column entry can be made up of three parts: a file descriptor, a mode character, and a lock character. Some common file descriptors are: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":239} --><\/p>\n<ul>\n<li> cwd: Current working directory. <\/li>\n<li> err: FD information error (see NAME column). <\/li>\n<li> ltx: Shared library text (code and data). <\/li>\n<li> m86: DOS Merge mapped file. <\/li>\n<li> mem: Memory-mapped file. <\/li>\n<li> mmap: Memory-mapped device. <\/li>\n<li> pd: Parent directory. <\/li>\n<li> rtd: Root directory. <\/li>\n<li> txt: Program text (code and data) <\/li>\n<li> A number, representing a file descriptor. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":569} --><\/p>\n<p> The mode character can be one of the following: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":618} --><\/p>\n<ul>\n<li> r: Read access. <\/li>\n<li> w: Write access. <\/li>\n<li> u: Read and Write access. <\/li>\n<li> &#8216; &#8216;: A space character, if the mode is unknown and there is no lock character. <\/li>\n<li> -: Mode unknown and there is a lock character. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":817} --><\/p>\n<p> The lock character can be one of: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":852} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":852,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":48,\"nextBlockCount\":245,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1097} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<ul>\n<li> r: Read lock on part of the file. <\/li>\n<li> R: Read lock on the entire file. <\/li>\n<li> w: Write lock on part of the file. <\/li>\n<li> W: Write lock on the entire file. <\/li>\n<li> u: Read and write lock of any length. <\/li>\n<li> U: Unknown lock type. <\/li>\n<li> &#8216; &#8216;: A space character. No lock. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":197} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":197} --><\/p>\n<h2 id=\"the-type-column\"><span class=\"ez-toc-section\" id=\"The_TYPE_Column\"><\/span> The TYPE Column <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> There are <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/lsof.8.html\">over 70 entries<\/a> that might appear in the TYPE column. Some common entries you will see are: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":300} --><\/p>\n<ul>\n<li> REG: Regular filesystem file. <\/li>\n<li> DIR: Directory. <\/li>\n<li> FIFO: First In First Out. <\/li>\n<li> CHR: Character special file. <\/li>\n<li> BLK: Block special file. <\/li>\n<li> INET: Internet socket. <\/li>\n<li> unix: UNIX domain socket <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":482} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":482} --><\/p>\n<h2 id=\"see-processes-that-have-opened-a-file\"><span class=\"ez-toc-section\" id=\"See_Processes_That_Have_Opened_a_File\"><\/span> See Processes That Have Opened a File <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see the processes that have opened a certain file, provide the name of the file as a parameter to <code>lsof<\/code>. For example, to see the processes that have opened <code>kern.log<\/code> file, use this command: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":674} --><\/p>\n<pre>sudo lsof \/var\/log\/kern.log<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":703} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"72\" loading=\"lazy\" alt=\"sudo lsof \/var\/log\/kern.log in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_906_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_906_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C72&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":943} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> <code>lsof<\/code> responds by displaying the single process, <code>rsyslogd<\/code> which was started by the user <code>syslog<\/code>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":96} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"149\" loading=\"lazy\" alt=\"lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_110_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_110_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C149&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":336} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":336} --><\/p>\n<h2 id=\"see-all-files-opened-from-a-directory\"><span class=\"ez-toc-section\" id=\"See_All_Files_Opened_from_a_Directory\"><\/span> See All Files Opened from a Directory <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see the files that have been opened from a directory, and the processes that opened them, pass the directory to <code>lsof<\/code> as a parameter. You must use the <code>+D<\/code> (directory) option. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":513} --><\/p>\n<p> To see all the files that are open in the <code>\/var\/log\/<\/code> directory, use this command: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":595} --><\/p>\n<pre>sudo lsof +D \/var\/log\/<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":619} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"sudo lsof +D \/var\/log\/ in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_883_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_883_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":859} --><\/p>\n<p> <code>lsof<\/code> responds with a list of all the open files in that directory. <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":927} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"238\" loading=\"lazy\" alt=\"lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_366_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147763_366_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C238&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":240} --><\/p>\n<p> To see all the files that have been opened from the <code>\/home<\/code> directory, use the following command: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":337} --><\/p>\n<pre>sudo lsof +D \/home<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":357} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Running &quot;lsof&quot; on the \/home directory. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_605_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_605_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":597} --><\/p>\n<p> The files have been opened from the <code>\/home<\/code> directory are displayed. Note that with shorter descriptions in some of the columns, the whole listing is narrower. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":756} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Files opened in the \/home directory. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_255_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_255_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":996} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":0} --><\/p>\n<h2 id=\"list-files-opened-by-a-process\"><span class=\"ez-toc-section\" id=\"List_Files_Opened_By_a_Process\"><\/span> List Files Opened By a Process <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see the files that have been opened by a particular process, use the <code>-c<\/code> (command) option. Note that you can provide more than one search term to <code>lsof<\/code> at once. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":163} --><\/p>\n<pre>sudo lsof -c ssh -c init<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":189} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Checking the files opened by the SSH process. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_153_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_153_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":429} --><\/p>\n<p> <code>lsof<\/code> provides a list of the files that have been opened by either of the processes provided on the command line. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":543} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"307\" loading=\"lazy\" alt=\"The files opened by the SSH process. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_50_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_50_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C307&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":783} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":783} --><\/p>\n<h2 id=\"see-files-opened-by-a-user\"><span class=\"ez-toc-section\" id=\"See_Files_Opened_By_a_User\"><\/span> See Files Opened By a User <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To limit the display to the files that have been opened by a specific user, use the <code>-u<\/code> (user) option. In this example, we&#8217;ll look at the files that have been opened by processes that are owned or launched on behalf of Mary. <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1012} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<pre>sudo lsof -u mary<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":19} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Listing the files opened by the user Mary. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_589_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147764_589_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":259} --><\/p>\n<p> All of the files listed have been opened on behalf of the user Mary. This includes files that have been opened by the desktop environment, for example, or simply as a result of Mary having logged in. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":460} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"A complete list of files opened by the Mary user. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_720_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_720_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":700} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":700} --><\/p>\n<h2 id=\"excluding-files-opened-by-a-user\"><span class=\"ez-toc-section\" id=\"Excluding_FIles_Opened_by_a_User\"><\/span> Excluding FIles Opened by a User <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To exclude the files that have been opened by a user, use the <code>^<\/code> operator. Excluding users from the listing makes it easier to find the information you are interested in. You must use the <code>-u<\/code> option as before, and add the <code>^<\/code> character to the start of the user&#8217;s name. <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":970} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<pre>sudo lsof +D \/home -u ^mary<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":29} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"List all of the files opened in \/home, except those opened by Mary. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_70_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_70_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":269} --><\/p>\n<p> This time, the listing for the <code>\/home<\/code> directory does not include any of the files that have been opened by the user Mary. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":391} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"A reduced list of files in \/home that have been opened. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_355_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_355_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":631} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":631} --><\/p>\n<h2 id=\"list-files-opened-by-a-process\"><span class=\"ez-toc-section\" id=\"List_FIles_Opened_by_a_Process\"><\/span> List FIles Opened by a Process <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To list the files that have been opened by a specific process, use the <code>-p<\/code> (process) option and provide the process ID as a parameter. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":766} --><\/p>\n<pre>sudo lsof - p 4610<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":786} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":786,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":114,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1026} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Checking files opened by a specific process. In this example, process 4610. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_482_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147765_482_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":126} --><\/p>\n<p> All of the files that have been opened by the process ID you provide are listed for you. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":216} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"A list of files opened by the specified process. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_619_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_619_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":456} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":456} --><\/p>\n<h2 id=\"listing-process-ids-that-have-opened-a-file\"><span class=\"ez-toc-section\" id=\"Listing_Process_IDs_That_Have_Opened_a_FIle\"><\/span> Listing Process IDs That Have Opened a FIle <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see the process IDs for the processes that have opened a particular file, use the <code>-t<\/code> (terse) option and provide the name of the file on the command line. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":614} --><\/p>\n<pre>sudo lsof -t \/usr\/share\/mime\/mime.cache<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":655} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Using lsof to view a list of processes that have accessed a specific file. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_751_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_751_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":895} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":895,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":5,\"nextBlockCount\":49,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":944} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<p> The process IDs are displayed in a simple list. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":44} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"307\" loading=\"lazy\" alt=\"The list of process IDs that have opened the mime.cache file. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_388_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_388_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C307&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":284} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":284} --><\/p>\n<h2 id=\"use-and-and-or-searches\"><span class=\"ez-toc-section\" id=\"Use_AND_and_OR_Searches\"><\/span> Use AND and OR Searches <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> Let&#8217;s list the files that have been opened by user Mary, that are related to the SSH processes. We know we can provide more than one search item on the command line, so this should be easy. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":479} --><\/p>\n<pre>sudo lsof -u mary -c ssh<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":505} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"sudo lsof -u mary -c ssh in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_686_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147766_686_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":745} --><\/p>\n<p> Now let&#8217;s look at the output from <code>lsof<\/code>. That doesn&#8217;t look right; there are entries in the output that were started by root. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":878} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":878,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":22,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1118} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147767_286_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147767_286_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":218} --><\/p>\n<p> That isn&#8217;t what we expected. What happened? <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":267} --><\/p>\n<p> When you provide multiple search terms <code>lsof<\/code> will return any file that matches the first search term or the second search term, and so on. In other words, it performs an OR search. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":448} --><\/p>\n<p> To make <code>lsof<\/code> perform an AND search, use the <code>-a<\/code> (and) option. This means the only files that will be listed will be ones that match the first search term, and the second search term, and so on. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":642} --><\/p>\n<p> Let&#8217;s try that again and use the <code>-a<\/code> option. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":691} --><\/p>\n<pre>sudo lsof -u mary -c ssh -a<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":720} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"sudo lsof -u mary -c ssh -a in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147767_919_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147767_919_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":960} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> Now every file in the listing is one that has been opened by or on behalf of Mary, and are associated with the SSH command. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":125} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147767_666_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147767_666_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":365} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":365} --><\/p>\n<h2 id=\"automatically-refreshing-the-display\"><span class=\"ez-toc-section\" id=\"Automatically_Refreshing_The_Display\"><\/span> Automatically Refreshing The Display <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> We can use the <code>+|-r<\/code> (repeat) option to put <code>lsof<\/code> into repeat mode. The repeat option can be applied in two ways, either <code>+r<\/code> or <code>-r<\/code>. We must also add the number of seconds we want <code>lsof<\/code> to wait before refreshing the display. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":586} --><\/p>\n<p> Using the repeat option in either format makes <code>lsof<\/code> display the results as usual, but it adds a dashed line to the bottom of the display. It waits for the number of seconds provided on the command line and then refreshes the display with a new set of results. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":847} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":847,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":53,\"nextBlockCount\":166,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1013} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<p> With the <code>-r<\/code> option this will continue until you press Ctrl+C. With the <code>+r<\/code> format, it will continue until there are no results to display, or until you press Ctrl+C. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":113} --><\/p>\n<pre>sudo lsof -u mary -c ssh -a -r5<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":146} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"sudo lsof -u mary -c ssh -a -r5 in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_492_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_492_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":386} --><\/p>\n<p> Note the dashed line at the bottom of the listing. This separates each new display of data when the output is refreshed. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":508} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"the righttmost columns of lsof output in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147762_399_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147762_399_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":748} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":748} --><\/p>\n<h2 id=\"displaying-files-associated-with-internet-connections\"><span class=\"ez-toc-section\" id=\"Displaying_Files_Associated_with_Internet_Connections\"><\/span> Displaying Files Associated with Internet Connections <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The <code>-i<\/code> (internet) option allows you to see the files opened by processes associated with network and internet connections. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":872} --><\/p>\n<pre>lsof -i<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":881} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":881,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":19,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1121} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Running &quot;lsof -i&quot; in a Terminal. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_504_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_504_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":221} --><\/p>\n<p> All of the files opened by network and internet connections are displayed. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":297} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"354\" loading=\"lazy\" alt=\"The output of &quot;lsof -i&quot;\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_748_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_748_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C354&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":537} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":537} --><\/p>\n<h2 id=\"displaying-files-associated-with-internet-connections-by-process-id\"><span class=\"ez-toc-section\" id=\"Displaying_Files_Associated_with_Internet_Connections_by_Process_ID\"><\/span> Displaying Files Associated with Internet Connections by Process ID <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see the files opened by internet connections that are associated with a specific process ID, add the <code>-p<\/code> option and the <code>-a<\/code> option. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":671} --><\/p>\n<p> Here we are looking for files opened by an internet or network connection, by a process with an ID of 606. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":779} --><\/p>\n<pre>sudo lsof -i -a -p 606<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":803} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":803,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":97,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1043} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"We have narrowed our search to only internet connections with a process ID of 606. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_264_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147768_264_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":143} --><\/p>\n<p> All of the files opened by process ID 606 that are associated with internet or network connections are displayed. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":258} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"167\" loading=\"lazy\" alt=\"Every file associated with an Internet connection that has been opened by process 606. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_167_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_167_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C167&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":498} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":498} --><\/p>\n<h2 id=\"displaying-files-associated-with-internet-connections-and-commands\"><span class=\"ez-toc-section\" id=\"Displaying_Files_Associated_with_Internet_Connections_and_Commands\"><\/span> Displaying Files Associated with Internet Connections and Commands <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> We can use the <code>-c<\/code> (command) option to look for files opened by specific processes. To look for files that have been opened by internet or network connections associated with the <code>ssh<\/code> process, use the following command: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":717} --><\/p>\n<pre>lsof -i -a -c ssh<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":736} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"Searching for files associated with the SSH process. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_768_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_768_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":976} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> All of the files opened due to the ssh processes are listed in the output. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":76} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"167\" loading=\"lazy\" alt=\"Files associated with the SSH process. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_671_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_671_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C167&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":316} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":316} --><\/p>\n<h2 id=\"displaying-files-associated-with-internet-connections-and-ports\"><span class=\"ez-toc-section\" id=\"Displaying_Files_Associated_with_Internet_Connections_and_Ports\"><\/span> Displaying Files Associated with Internet Connections and Ports <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> We can make <code>lsof<\/code> report on the files that were opened by internet or network connections on a specific port. To do this, we use the <code>:<\/code> character followed by the port number. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":490} --><\/p>\n<p> Here we&#8217;re asking <code>lsof<\/code> to list the files that have been opened by network or internet connections using port 22. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":608} --><\/p>\n<pre>lsof -i :22<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":621} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"List associations between file access and a given port. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_383_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147769_383_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":861} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":861,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":39,\"nextBlockCount\":123,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":984} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<p> All of the listed files were opened by processes associated with port 22 (which is the default port for SSH connections). <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":84} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"167\" loading=\"lazy\" alt=\"List of files accessed by a process using port 22. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147770_823_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147770_823_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C167&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":324} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":324} --><\/p>\n<h2 id=\"displaying-files-associated-with-internet-connections-and-protocols\"><span class=\"ez-toc-section\" id=\"Displaying_Files_Associated_with_Internet_Connections_and_Protocols\"><\/span> Displaying Files Associated with Internet Connections and Protocols <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> We can ask <code>lsof<\/code> to show the files that have been opened by processes associated with network and internet connections, that are using a specific protocol. We can choose from TCP, UDP, and SMTP. Let&#8217;s use the TCP protocol and see what we get. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":571} --><\/p>\n<pre>sudo lsof -i tcp<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":589} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"List files accessed via the TCP protocol. \" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147770_596_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147770_596_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":829} --><\/p>\n<p> The only files listed are those opened by processes that are using the TCP protocol. <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":915} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"A list of applications that have accessed files from the Internet using the TCP protocol.\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147770_517_How-to-Use-the-Linux-lsof-Command.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/1725147770_517_How-to-Use-the-Linux-lsof-Command.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":240} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":240} --><\/p>\n<h2 id=\"we-39-ve-only-scratched-the-surface\"><span class=\"ez-toc-section\" id=\"Weve_Only_Scratched_the_Surface\"><\/span> We&#8217;ve Only Scratched the Surface <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> That&#8217;s a good grounding in some common use cases for <code>lsof<\/code>, but there is a lot more to it than that. Just how much more can be judged by the fact the man page is over 2,800 lines long. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":429} --><\/p>\n<p> The <code>lsof<\/code> command can be used to drill ever deeper into the strata of open files and pseudo-files. We&#8217;ve provided a sketch map; the atlas is in <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/lsof.8.html\">the man page<\/a>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":591} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":911} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways Linux simplifies handling a wide range of different resources by treating devices that accept or generate byte streams as files. The lsof command can be used to list open files in the system, including processes and devices treated as files. lsof can be used to search for files opened by specific processes, directories, &#8230; <a title=\"How to Use the Linux lsof Command\" class=\"read-more\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-the-linux-lsof-command\/\" aria-label=\"Read more about How to Use the Linux lsof Command\">\u0625\u0642\u0631\u0623 \u0627\u0644\u0645\u0632\u064a\u062f<\/a><\/p>\n","protected":false},"author":1,"featured_media":35247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6],"tags":[42,43],"class_list":["post-35246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-linux","tag-linux-macos-terminal"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/08\/How-to-Use-the-Linux-lsof-Command.jpg?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/posts\/35246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/comments?post=35246"}],"version-history":[{"count":0,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/posts\/35246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/media\/35247"}],"wp:attachment":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/media?parent=35246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/categories?post=35246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/tags?post=35246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}