When managing your Linux server, you may encounter lag or other performance issues that lead you to question what files your server might be accessing at a given time. Or you might just want to run routine diagnostics to make sure your server is only running and manage files that it is supposed to run. You may also need to remove a file or unmount a drive but cannot because the system tells you that it is being accessed by a program. Regardless of the reason, you need a tool that can shed light on what is files are being accessed. The command lsof is exactly what you need.
If a file is open on your server, lsof will tell you what user has it open, the type of file it is, the node associated with it and more. You should note that Linux will consider directories, devices, pipes, sockets and anything else on the file system as a file.
To use lsof, simply type it from the command line:
The output will look like this:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 1275 mysql 12u unix 0xffff8801fe724680 0t0 10184 /var/run/mysqld/mysqld.sock
mysqld 1275 mysql 13u REG 8,18 2048 21248418 /var/lib/mysql/mysql/host.MYI
mysqld 1275 mysql 14u REG 8,18 0 21248832 /var/lib/mysql/mysql/host.MYD
mysqld 1275 mysql 15u REG 8,18 2048 21247064 /var/lib/mysql/mysql/user.MYI
mysqld 1275 mysql 16u REG 8,18 928 21247125 /var/lib/mysql/mysql/user.MYD
mysqld 1275 mysql 17u REG 8,18 5120 21247493 /var/lib/mysql/mysql/db.MYI
mysqld 1275 mysql 18u REG 8,18 1760 21248784 /var/lib/mysql/mysql/db.MYD
mysqld 1275 mysql 19u REG 8,18 5120 21254689 /var/lib/mysql/mysql/proxies_priv.MYI
In the above example, the command is “mysqld”, which is a database server run by the “mysql” user. The first file being accessed is mysqld.sock. The FD column provides useful information. For example, the number 12 is the file descriptor, and “u” indicates that the file allows both read and write access.