Complete Guide to the lsof Command: Master System Troubleshooting from Beginner to Pro

On Unix-like systems, lsof (List Open Files) is a powerful command-line tool that lists all "open files" in the system, including regular files, directories, and network sockets. This article expands on the original content by adding PID (Process ID) retrieval, process start/stop operations, and complete parameter explanations, helping you fully leverage lsof to solve real-world problems efficiently. It’s ideal for system administrators and developers looking to enhance system debugging capabilities.

1. Basic Syntax and Core Concepts of lsof

1.1 Basic Syntax

lsof [options] [filename/arguments]

• Regular users can only view their own process information.

• Root users have access to all system processes.

• Output fields include COMMAND (process name), PID (Process ID), USER (user), FD (file descriptor), TYPE (file type), and NAME (path/network information).

2. Retrieving Process PIDs and Managing Processes with lsof

In daily work, it’s common to retrieve PIDs via process names or execution paths, then perform start, stop, or restart operations. Combine lsof with other commands for efficient task completion.

2.1 Retrieve PID by Process Name

Scenario: Obtain the PID when the process name is known (e.g., nginx, java). Method: Use the -c option to match the process name and -t to output only the PID.

# Get PIDs of all processes containing "nginx" in the name
lsof -t -cnginx
​
# Example output (multiple PIDs displayed line by line)
1234
1235

2.2 Retrieve PID by Execution Path

Scenario: Locate the PID when the executable file path is known (e.g., /usr/bin/nginx). Method: Specify the path directly as an argument and use -t to output the PID.

# Get PID via executable file path
lsof -t /usr/bin/nginx
​
# Example output
1234

2.3 Stop/Kill a Process

Scenario: Terminate abnormal processes after retrieving their PIDs. Method: Combine with the kill command for batch operations.

# Kill all processes containing "nginx" in the name
kill -9 $(lsof -t -c nginx)
​
# Kill processes by specified path (e.g., /usr/bin/java)
kill -9 $(lsof -t /usr/bin/java)

2.4 Restart a Process

Scenario: Restart a process after modifying configurations (using nginx as an example). Method: Stop the process first, then start it (startup methods vary by service).

# Stop nginx
kill -9 $(lsof -t -c nginx)
# Start nginx (adjust path as needed)
/usr/bin/nginx

3. Complete Parameter Explanations (SYNOPSIS)

Below is a concise overview of each option’s function and examples, organized by parameter format:

4. Practical High-Frequency Scenarios

4.1 Troubleshoot Port Occupancy

# Find processes occupying port 80
lsof -i:80
# Kill the occupying process
kill -9 $(lsof -t -i :80)

4.2 Unreleased Disk Space

# Locate deleted but still occupied files
lsof +L1
# Restart occupying processes to free up space
systemctl restart $(lsof -t +L1 | xargs ps -p | awk 'NR>1 {print $4}')

4.3 Unable to Delete a Directory Due to Occupancy

# Find processes occupying /var/www
lsof +D /var/www
# Terminate processes and delete the directory
kill -9 $(lsof -t +D /var/www) && rm -rf /var/www

4.4 Monitor Network Connections for a Specific User

# Real-time monitor TCP connections for "testuser" (refresh every 3 seconds)
lsof -nP -itcp -utestuser -r 3

5. Conclusion

The core value of the lsof command lies in linking processes, files, and networks. With the added PID retrieval and process management techniques in this article, you can further improve system debugging efficiency. Whether locating PIDs via process names/paths or troubleshooting ports and disk issues with parameter combinations (e.g., -c + -t, +L1, -i), flexible use of lsof will help you resolve problems quickly. For complete parameters, refer to man lsof and gradually master this "Swiss Army knife" of system troubleshooting.

Tags: lsof command, process management, PID retrieval, port occupancy, Linux commands, system troubleshooting, process start/stop