LSOF: Who's doing what

Sometimes i got problems on identifing what kind of thing is doing a specified process.
First of all, you need to identify your process in "ps -efl" list.

To learn what program is listening on wich port:

netstat -tlnp

You can also identify processes using files or sockets:

fuser [FILENAME]

now check if you have LSOF utility on you machine.

locate lsof

probably you will find it under "/usr/sbin/lsof".
LSOF (LiSt Open Files) is a useful and powerful tool that will show you opened files.

When lsof is called without parameters, it will show all the files opened by any processes.

lsof | nl

Other examples on who is using the apache executable file, /etc/passwd, what files are opened on device /dev/hda6 or who's accessing /dev/cdrom:

lsof `which apache2`
lsof /etc/passwd
lsof /dev/hda6
lsof /dev/cdrom


What process IDs are using the apache binary, and only the PID?

lsof -t `which apache2`


what files are opened by processes whose names starts by "k" (klogd, kswapd...) and bash?

lsof -c k
lsof -c bash

what files are opened by init?

lsof -c init


what files are opened by processes whose names starts by "courier", but exclude those whose owner is the user "mack"?

lsof -c courier -u ^mack


processes opened by user apache and user mack:

lsof -u apache,mack

Show what files are using the process whose PID is 30297:

lsof +p 30297

Search for all opened instances of directory /tmp and all the files and directories it contains:

lsof +D /tmp

List all opened internet sockets and sockets related to port 80:

lsof -i
lsof -i :80

List all opened Internet and UNIX domain files:

lsof -i -U

Show us what process(es) has an UDP connection opened to or from the host www.akadia.com at port 123 (ntp):

lsof -iUDP@www.akadia.com:123




(about LSOF: http://www.akadia.com/services/lsof_intro.html)