lsof is a practical tool for viewing the files that the process is using. The basic command is lsof -p PID. 1. You need to search the process ID first through ps or pgrep. 2. After executing the command, you can see all files and network connections opened by the process. 3. The key fields in the output include COMMAND, PID, USER, FD, TYPE and NAME. 4. You can use common combinations such as lsof -i -p PID to display network connections, lsof -u username to check all process files of a user, lsof -i :80 to view port occupation, lsof -p PID -r 1 to monitor changes in real time. 5. Note that you need permission to view other user processes. When not installed, you can install them through the package manager. If you find resource leaks, you should further troubleshoot the code or configuration.

lsof (List Open Files) is a very practical command-line tool when you want to view the files a process is using. It can be used in both Linux and macOS systems to troubleshoot the relationship between processes and files.

Basic command format

To see which files are opened by a process, the basic command structure is as follows:

 lsof -p PID

Where PID is the process ID you want to query. After execution, you will see all the files opened by this process, including regular files, network connections, devices, etc.

Find process ID

Before using lsof , you usually need to know the PID of the target process. You can use ps or pgrep to find:

• Use ps to find:

   ps aux | grep process name

• Use pgrep to get the PID directly:

   pgrep process name

For example, if you want to check the process ID of nginx, you can run:

 pgrep nginx

If multiple results are returned, it means that there are multiple instances running.

Common output fields description

After running lsof -p PID , you will see an output similar to the following:

 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1234 root 6u IPv4 123456 0t0 TCP *:http (LISTEN)
nginx 1234 root 7u IPv6 123457 0t0 TCP *:http (LISTEN)
nginx 1234 root 8w REG 8,1 1024 1234 /var/log/nginx/access.log

The key columns are explained as follows:

• COMMAND : Process name
• PID : Process ID
• USER : The user running the process
• FD : File descriptor number and type (such as cwd, txt, mem, 0u, 1w, etc.)
• TYPE : file type (such as REG represents a normal file, IPv4/IPv6 represents a network connection)
• NAME : File or network address

Through this information, you can determine whether a process has a specific log file, configuration file, or network port.

Common options combinations

The following are some practical lsof combination commands suitable for different scenarios:

• Only the files related to the network connection are displayed:

   lsof -i -p PID

• Displays files opened by all processes running by a user:

   lsof -u username

• Check which process takes up a port (such as port 80):

   lsof -i:80

• Real-time monitoring of changes (refreshed once every second):

   lsof -p PID -r 1

  These combinations can be flexibly combined according to specific issues.

  ---

  Notes and FAQs

  • sudo is required to view other users' processes.
  • lsof is not installed by default on some systems, and can be installed through a package manager (such as apt install lsof or brew install lsof ).
  • If you find that a process occupies a large number of files but is not released, it may be a resource leak and further troubleshooting of the code or configuration is required.

  ---

  Basically that's it. Mastering a few common commands can quickly locate most file or network-related problems.

  The above is the detailed content of How to check for open files by a process using lsof?. For more information, please follow other related articles on the PHP Chinese website!