- +D D List opened files under a directory(recurse)
- +d D List opened files under a directory(don't recurse)
- -c c List opened files based on process names starting with
- -u s List files opened by a specific user
- -p s List all open files by a specific process
- -i [i] List all network connections
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 8,1 4096 2 /
init 1 root txt REG 8,1 124704 917562 /sbin/init
FD – Represents the file descriptor.
- cwd – Current Working Directory
- txt – Text file
- mem – Memory mapped file
- mmap – Memory mapped device
- NUMBER – Represent the actual file descriptor.The character after the number i.e ’1u’, represents the mode in which the file is opened. r for read, w for write, u for read and write.
TYPE - Specifies the type of the file.
- REG – Regular File
- DIR – Directory
- FIFO – First In First Out
- CHR – Character special file
$ lsof |grep deleted
sendmail 1761 smmsp 3uW REG 253,0 1392332800 9276903 /var/spool/clientmqueue/dfr5C0iDfq001761 (deleted)
sendmail 3380 smmsp 3uW REG 253,0 1239724032 9277076 /var/spool/clientmqueue/dfr696K5ln003380 (deleted)