Find Out What Files Are Open On Your Linux Server

When managing your Linux server, you may encounter lag or other performance issues that lead you to question what files your server might be accessing at a given time. Or you might just want to run routine diagnostics to make sure your server is only running and manage files that it is supposed to run. You may also need to remove a file or unmount a drive but cannot because the system tells you that it is being accessed by a program. Regardless of the reason, you need a tool that can shed light on what is files are being accessed. The command lsof is exactly what you need.

If a file is open on your server, lsof will tell you what user has it open, the type of file it is, the node associated with it and more. You should note that Linux will consider directories, devices, pipes, sockets and anything else on the file system as a file.

To use lsof, simply type it from the command line:

# lsof

The output will look like this:


mysqld 1275 mysql 12u unix 0xffff8801fe724680 0t0 10184 /var/run/mysqld/mysqld.sock

mysqld 1275 mysql 13u REG 8,18 2048 21248418 /var/lib/mysql/mysql/host.MYI

mysqld 1275 mysql 14u REG 8,18 0 21248832 /var/lib/mysql/mysql/host.MYD

mysqld 1275 mysql 15u REG 8,18 2048 21247064 /var/lib/mysql/mysql/user.MYI

mysqld 1275 mysql 16u REG 8,18 928 21247125 /var/lib/mysql/mysql/user.MYD

mysqld 1275 mysql 17u REG 8,18 5120 21247493 /var/lib/mysql/mysql/db.MYI

mysqld 1275 mysql 18u REG 8,18 1760 21248784 /var/lib/mysql/mysql/db.MYD

mysqld 1275 mysql 19u REG 8,18 5120 21254689 /var/lib/mysql/mysql/proxies_priv.MYI

In the above example, the command is “mysqld”, which is a database server run by the “mysql” user. The first file being accessed is mysqld.sock. The FD column provides useful information. For example, the number 12 is the file descriptor, and “u” indicates that the file allows both read and write access.

For more information about lsof and all it can do, type “man lsof”, see the online documentation or read this tutorial.