lsof Cheat Sheet

List open files — which process holds a port, opened a deleted file, or is bleeding disk space.

Troubleshooting3 sections · 15 commands
⌘K

Ports & Network

6
lsof -iTCP:443

Who is listening on port 443

lsof -i :8080

Any protocol on 8080

lsof -iTCP -sTCP:ESTABLISHED

Established connections

lsof -iUDP

UDP sockets

lsof -i

Every network file

lsof -iTCP@host

Connections to a host

By Process & User

6
lsof -p PID

All open files of a process

lsof -u USER

Files opened by a user

lsof -c nginx

Processes whose name matches

lsof -a -p PID -i

AND both filters

lsof +D DIR

Files under a directory (recursive)

lsof | grep nginx

Grep the whole table

Deleted & Disk

3
lsof +L1

Deleted files still open (disk leak)

lsof +L1 | awk '{print $7}' | sort | uniq -c | sort -rn | head

Biggest deleted-file holders

lsof -nP

No name resolution (faster)