Quick take: The lsof command lists open files and the processes that hold them — and in Linux, almost everything is a file. Use lsof -i :PORT to find what is using a port and lsof /path to see what is using a file or mount.
Introduction
In Linux, nearly everything is a file — regular files, directories, sockets, and devices — and the lsof command (list open files) reveals which processes have them open. That makes it the tool for answering questions like “what is using this port?”, “why can't I unmount this drive?”, and “which process has this file locked?”.
This guide covers finding what is using a port, a file, or a mount point, and listing the files a particular process has open.
Syntax
The basic syntax of the lsof command is:
lsof [OPTIONS] [NAMES]Common Options and Parameters
The most useful options and parameters for the lsof command:
| Option | Description |
|---|---|
| -i [:PORT] | List network connections, optionally for a port. |
| -i TCP:PORT | List processes using a specific TCP port. |
| -p PID | List files opened by a specific process. |
| -u USER | List files opened by a user. |
| -c NAME | List files opened by processes named NAME. |
| +D DIR | List open files under a directory. |
| -t | Output only PIDs (useful for scripting). |
Practical Examples
Real lsof commands you can run today:
# What is listening on port 8080?
sudo lsof -i :8080
# All network connections
sudo lsof -i
# What is using a file or mount?
lsof /var/log/app.log
# Files opened by a process
lsof -p 4821
# Files opened by nginx
sudo lsof -c nginx
# Kill whatever is holding a port
sudo kill $(lsof -t -i:8080)Tips and Best Practices
lsof -i :PORTis the definitive answer to “what is using this port?” when a service will not start.- When
umountfails with “target is busy”, runlsof /mnt/pointto find the process holding it open. lsof -tprints just PIDs, which you can feed straight intokillto free a resource.
Final Thoughts
lsof turns Linux's “everything is a file” philosophy into a diagnostic superpower — revealing exactly which process holds a port, file, or mount. Learn -i :PORT for port conflicts and lsof /path for busy files, and you can resolve “address already in use” and “device is busy” errors in seconds. It complements ss and ps perfectly.
FAQ: lsof Command in Linux
How do I find what is using a port in Linux?+
Use sudo lsof -i :PORT, for example sudo lsof -i :8080. It lists the process and PID holding the port, which is the fix for 'address already in use' errors. ss -tulnp does the same job.
How do I find what process is using a file?+
Run lsof /path/to/file to list every process with that file open. This is how you discover what is keeping a log or device busy.
Why can't I unmount a device, and how does lsof help?+
umount fails when a process has files open on the mount. Run lsof /mnt/point to identify the process, then close it or cd out of the directory before unmounting.
How do I list all files a process has open?+
Use lsof -p PID to list every file, socket, and device that process currently holds open. lsof -c name does the same by process name.
How do I kill whatever is using a port?+
Combine lsof and kill: sudo kill $(lsof -t -i:8080). The -t flag outputs only the PID, which kill then terminates. Use -9 if it does not stop.
Need help with Linux servers or infrastructure?
Work directly with Muhammad Irfan Aslam for Linux, Ubuntu, Docker, DevOps, cloud, CI/CD, or infrastructure support.
Hire Me for Support