### Install lsof

Source: https://context7.com/lsof-org/lsof/llms.txt

Install lsof using the system's package manager or build from source.

```shell
# Debian/Ubuntu
sudo apt install lsof

# RHEL/CentOS
sudo yum install lsof

# Arch Linux
sudo pacman -Syu lsof

# NixOS
nix-env -i lsof

# Build from source (autotools, Linux/Darwin/FreeBSD)
./configure
make
make install

# Build from source (legacy, all dialects)
./Configure linux   # replace "linux" with your dialect
make
bash check.bash linux   # run tests
```

--------------------------------

### lsof -V -c inetd example with security options

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

This example shows how compile-time security options can prevent -V from reporting a search failure for a command, even if the process exists, if specific file types are restricted.

```bash
$ lsof -V -c inetd
```

--------------------------------

### Install lsof on NixOS

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Install lsof on NixOS or other nix-based distributions using the nix-env command.

```shell
nix-env -i lsof
```

--------------------------------

### Build command with custom flags

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Example of a make command with specific DEBUG and CFGF flags for building Lsof on AIX.

```shell
$ make
(cd lib; make DEBUG="-O" CFGF="-DAIXA=0 -DAIXV=4330 \
	-DLSOF_VSTR=\"4.3.3.0\"")
gcc  -DAIXA=0 -DAIXV=4330 -DLSOF_VSTR="4.3.3.0" -O \
	-c ckkv.c
In file included from ckkv.c:33:
../machine.h:70:
sys/types.h: A file or directory in the path name \
does not exist. \

```

--------------------------------

### Install lsof on Debian/Ubuntu

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Install lsof on Debian, Ubuntu, or other apt-based Linux distributions using the apt package manager.

```shell
sudo apt install lsof
```

--------------------------------

### Example Output from idrlogin.perl (UnixWare)

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

This output shows the results from running idrlogin.perl on a UnixWare system, detailing network connection information for logged-in users.

```shell
tweeker: 1 = cd src/lsof4/scripts
tweeker: 9 = ./idrlogin.perl
Login    Shell       PID Via           PID TTY        From
abe      ksh        9438 in.telnetd   9436 pts/3      lsof.itap.purdue.edu
```

--------------------------------

### Install lsof on Arch Linux

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Install lsof on Arch Linux or other pacman-based distributions using the pacman package manager.

```shell
sudo pacman -Syu lsof
```

--------------------------------

### Example Output from idrlogin.perl (Solaris)

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

This output demonstrates the format of information provided by the idrlogin.perl script on a Solaris system, showing login details, shell, PIDs, and connection information.

```shell
centurion: 1 = cd src/lsof4/scripts
centurion: 2 = ./idrlogin.perl
Login    Shell       PID Via           PID TTY        From
oboyle   ksh       12640 in.telnetd  12638 pts/5      opal.cc.purdue.edu
icdtest  ksh       15158 in.rlogind  15155 pts/6      localhost
sh       csh       18207 in.rlogind  18205 pts/1      babylon5.cc.purdue.edu
root     csh       18242 in.rlogind  18205 pts/1      babylon5.cc.purdue.edu
trouble  ksh       19208 in.rlogind  18205 pts/1      babylon5.cc.purdue.edu
abe      ksh       21334 in.rlogind  21332 pts/2      lsof.itap.purdue.edu
```

--------------------------------

### lsof -V -i TCP@foobar -a -d 999 example

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

This example demonstrates a scenario where -V might not report a search failure because other options like -a and -d 999 participate in the search criteria.

```bash
$ lsof -V -i TCP@foobar -a -d 999
```

--------------------------------

### List Files Open by Sendmail Command

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

An example of using the -c option to list all files opened by processes associated with the 'sendmail' command. This demonstrates how to target specific applications.

```shell
$ lsof -c sendmail
```

--------------------------------

### Select Process ID, Command Name, File Descriptor, and File Name Fields

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

This example demonstrates selecting specific fields (process ID, command name, file descriptor, and file name) with a newline field terminator.

```bash
lsof -F pcfn
```

--------------------------------

### Compile lsof with gcc

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Example of compiling lsof using make and gcc, which may trigger header file errors.

```bash
$ make
(cd lib; make DEBUG="-O" CFGF="-Dsolaris=80000 \
	-DHASPR_GWINDOWS -m64 -DHASIPv6 -DHAS_VSOCK \
	-DLSOF_VSTR=\"5.8\"")
gcc -Dsolaris=80000  -DHASPR_GWINDOWS -m64 -DHASIPv6 \
-DHAS_VSOCK -DLSOF_VSTR="5.8"  -O  -c  dvch.c
In file included from /usr/include/sys/proc.h:31, \
from /homes/abe/gnu/gcc-3.2.1/lib/gcc-lib/sparcv9-sun-solaris2/ \
3.2.1/include/sys/user.h:267, from /usr/include/kvm.h:13, \
from ../dlsof.h:53, from ../lsof.h:172, from dvch.c:43: \
/homes/abe/gnu/gcc-3.2.1/lib/gcc-lib/sparcv9-sun-solaris2/ \
3.2.1/include/sys/task.h:59: parse error before "uint_t"
```

--------------------------------

### lsof Output for Specific Process Group Example

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

Example output from lsof when filtering by process group ID and current working directory.

```shell
$ lsof -g12717 -adcwd
COMMAND   PID  PGID USER  FD TYPE DEVICE SIZE/OFF    NODE NAME
sshd    11369 12717 root cwd VDIR    0,2      189 1449175 /tmp (swap)
sshd    12717 12717 root cwd VDIR  136,0     1024       2 /
```

--------------------------------

### Build lsof with Autotools

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Commands to build lsof using the experimental autotools build system. This includes configuration, compilation, and installation.

```shell
# If you are building from git sources
# autoreconf -vif
./configure
make
make install
```

--------------------------------

### Install lsof on RHEL/CentOS

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Install lsof on RHEL, CentOS, or other yum-based Linux distributions using the yum package manager.

```shell
sudo yum install lsof
```

--------------------------------

### List All Open Internet Sockets

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

Use the -i option without further arguments to list all open Internet socket files on your machine. This is a good starting point for network troubleshooting.

```shell
$ lsof -i
```

--------------------------------

### Build lsof with Legacy System

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Use these commands to build lsof using the legacy build system. Ensure you replace '<dialect>' with your specific operating system dialect.

```shell
./Configure <dialect>
make
```

--------------------------------

### Example of lsof command regular expression

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

This example demonstrates an extended regular expression used with the -c option in lsof. It matches exactly four characters, with a case-insensitive check for 'o' as the third character. The 'i' modifier ignores case.

```bash
-c /^..o.$/i
```

--------------------------------

### Generate Release Archive

Source: https://github.com/lsof-org/lsof/blob/master/docs/maintaining.md

Use these commands to configure the build for a specific dialect and create a distributable source archive.

```bash
   $ ./Configure [dialect]
   $ make dist
```

--------------------------------

### List All Open Files

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Use this command to display all open files on the system.

```bash
lsof
```

--------------------------------

### lsof kernel name cache hash size error example

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

An example warning message from lsof indicating a 'name cache hash size length error: 0', often seen on FreeBSD systems when there's a mismatch in kernel symbol addresses.

```text
lsof: WARNING: name cache hash size length error: 0
```

--------------------------------

### Build and Test Lsof

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Commands to build and run the Lsof test suite after configuration. Ensure the lsof tree has not been severely cleaned or purged before running.

```bash
$ make
$ cd tests
$ make
```

```bash
$ cd test
$ make
# or
$ <run a single test>    (See 00TEST.)
```

--------------------------------

### Create and use mount table supplement file with lsof

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

When NFS file systems are inaccessible, use '+m' to create a supplement file and '+m m' to use it for obtaining device numbers.

```bash
$ rm -f $HOME/mnt-sup
$ lsof +m > $HOME/mnt-sup
...
$ lsof +m $HOME/mnt-sup <other lsof options>
```

--------------------------------

### Select Fields with NUL Terminator

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

This example shows how to select the same fields as above but with a NUL (000) field terminator, which can be useful for scripting with tools like xargs.

```bash
lsof -F pcfn0
```

--------------------------------

### List Files on Any Port of a Host

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

To list all files using any protocol on any port of a specified host, simply provide the hostname. The default domain will be appended if not fully qualified.

```bash
lsof -i @mace
```

--------------------------------

### List Internet and UNIX Domain Files

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

This command lists all open Internet, x.25 (HP-UX), and UNIX domain files.

```bash
lsof -i -U
```

--------------------------------

### Specify Kernel Boot File with -k Option

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Use the -k option to point lsof's kernel symbol address gathering at a specific boot file when encountering "garbage" output.

```bash
$ lsof -k /kernel.OLD
```

--------------------------------

### lsof reporting two instances of itself

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Illustrates the output when lsof reports two instances of itself, typically due to a parent-child process relationship for handling blocking kernel functions. This example is from HP-UX 11.

```text
COMMAND     PID USER   FD   TYPE     DEVICE ...
lsof      29450  abe    7w  PIPE 0x48732408 ...
lsof      29450  abe    8r  PIPE 0x48970808 ...
lsof      29451  abe    6r  PIPE 0x48732408 ...
lsof      29451  abe    9w  PIPE 0x48970808 ...
```

--------------------------------

### AND Selection Options with -a

Source: https://github.com/lsof-org/lsof/blob/master/docs/options.md

Use the -a option to logically AND selection criteria, instead of the default OR behavior. This refines results to match all specified conditions.

```bash
$ lsof -p1234 -au 5678
```

--------------------------------

### Test lsof with Legacy System

Source: https://github.com/lsof-org/lsof/blob/master/docs/getting-started.md

Run this command to test your lsof build after using the legacy build system. Replace '<dialect>' with your operating system dialect.

```shell
bash check.bash <dialect>
```

--------------------------------

### Send Signal to Processes Holding a File Open

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

To send a signal (e.g., SIGHUP) to processes that have a specific file open, use lsof -t to get the PIDs and pipe them to the kill command.

```bash
kill -HUP `lsof -t /u/abe/bar`
```

--------------------------------

### Use lsof -V for detailed error reporting

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Use the -V option with lsof to get detailed reports on what it couldn't find, helping to diagnose issues with file system specifications.

```bash
$ /lsof -V /tmp ./lsof.h ./lsof
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF  INODE NAME
lsof    2688  abe  txt   VREG 18,1,7  1428583 226641 ./lsof
lsof    2689  abe  txt   VREG 18,1,7  1428583 226641 ./lsof
lsof: no file use located: ./lsof.h
```

--------------------------------

### Build and Test Source Archive

Source: https://github.com/lsof-org/lsof/blob/master/docs/maintaining.md

Verify the integrity of the generated source archive by building and testing lsof from it.

```bash
$ cp support/lsof_4.94.0.linux.tar.bz2 /tmp
$ cd /tmp
$ tar jxvf lsof_4.94.0.linux.tar.bz2
$ cd lsof_4.94.0.linux
$ ./Configure linux
$ make
$ make check (if your dialect support the target)
```

--------------------------------

### Exclude UDP Network Files by State Idle

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Use the -i and -s options with a caret (^) prefix to exclude network files with a specific UDP state. This example lists all UDP files except those in the 'Idle' state.

```bash
-iUDP -sUDP:^Idle
```

--------------------------------

### lsof command regex not found example

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Demonstrates a scenario where lsof reports a command regex as not found due to option precedence. The '-c <command>' option matching first prevents subsequent '-c /RE/[m]' tests.

```bash
$ ./lsof -clsof -c/^..o.$/ -V -adcwd
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
lsof    7850  abe  cwd   VDIR    6,0     2048 96442 / (/dev/sd0a)
lsof: no command found for regex: ^..o.$
```

--------------------------------

### lsof device cache file error message pre-4.58

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Shows an example of an lsof error message prior to revision 4.58, where '\n' was used to indicate the terminating New Line character in device cache file entries.

```text
lsof: WARNING: no ...: 4 sections\n
```

--------------------------------

### List Files by User, Process ID, or Login Name

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Filter open files by specifying user IDs, login names, or process IDs. Multiple values can be comma-separated.

```bash
lsof -p 456,123,789 -u 1234,abe
```

--------------------------------

### List Current Working Directory with Regex Command Filter

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Use a regular expression with the -c option to filter commands based on patterns. This example lists the current working directory for commands exactly four characters long with 'o' or 'O' in the third character.

```bash
lsof -c /^..o.$/i -a -d cwd
```

--------------------------------

### List Files Open by Command Name

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

Use the -c option followed by the first few characters of a command name to list files open by all processes matching that command. This is a convenient way to inspect multiple instances of a command.

```shell
$ lsof -c <first_characters_of_command_name_that_interest_you>
```

--------------------------------

### Select Socket Options and States with lsof -T

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Use the -T option followed by selection characters to report socket options, states, and TCP flags. For example, -Tqs requests queue lengths and connection states. The -T option disables state reporting by default, requiring explicit selection.

```bash
# Example: Display queue lengths and connection states
lsof -Tqs
```

--------------------------------

### Find Open Files by User (-u)

Source: https://context7.com/lsof-org/lsof/llms.txt

Select files open by processes belonging to a login name or UID. Multiple entries are comma-separated; prefix '^' to exclude. Combine with '-a' for AND logic.

```shell
# Files for user "abe" or UID 548
$ lsof -u abe,548

# Exclude root processes entirely (useful for reducing noise)
$ lsof -u ^root
# equivalent
$ lsof -u ^0

# Combine with -a to list UNIX sockets belonging only to user foo
$ lsof -u foo -a -U
```

--------------------------------

### Search lsof Source for 'can't identify protocol' Message

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

Use grep to search the lsof source code for specific error messages, such as 'can't identify protocol'. This helps in understanding the cause of messages appearing in the NAME column. The example shows searching within the main source directory.

```shell
$ cd .../lsof_4.76_src
$ grep "can't identify protocol" *.[ch]
```

--------------------------------

### Select Files by User with lsof -u

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Use the -u option to list files owned by specific users, identified by login names or user IDs. Multiple entries are treated as an ORed set. Prepending '^' negates the selection, excluding files owned by that user.

```bash
# Select files for user 'abe' or user ID 548
lsof -u abe,548
```

```bash
# Exclude files owned by user 'root'
lsof -u ^root
```

--------------------------------

### Log Filesystem Users Ignoring Search Failures with -Q

Source: https://github.com/lsof-org/lsof/blob/master/docs/tutorial.md

This script uses the -Q option with lsof to log filesystem users. The -Q flag ensures a successful exit code (0) even if the search for specific files fails, allowing logging to proceed. It includes error handling for actual lsof execution errors.

```shell
#!/bin/sh
lsof -Q <file_system_name>  > fs_users.log
if test $? -ne 0
then
echo "Error: Something actually went wrong!" 1>&2
exit 1
fi
```

--------------------------------

### List Files on Specific Ports and Host

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

To list all files using any protocol on specific ports of a given host, specify the host and port range.

```bash
lsof -i @wonderland.cc.purdue.edu:513-515
```

--------------------------------

### List Internet Socket Files with -i

Source: https://github.com/lsof-org/lsof/blob/master/docs/options.md

Display Internet socket files. Can filter by protocol, address, or port. Multiple -i options can specify multiple addresses.

```bash
$ lsof -iTCP
```

```bash
$ lsof -i@lsof.itap.purdue.edu:sendmail
```

--------------------------------

### List open socket files for a process with lsof

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Use this command to display open socket files for a specific process ID. This is useful when lsof is compiled with security options that might otherwise restrict output.

```bash
$ lsof -p 12345 -a -i
```

--------------------------------

### List Open Files on a Specific Device

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

To list all open files residing on a particular device, provide the device path.

```bash
lsof /dev/hd4
```

--------------------------------

### Tagging a Release with Git

Source: https://github.com/lsof-org/lsof/blob/master/docs/maintaining.md

Create and push Git tags for a release. Includes commands for deleting a tag if a mistake is made.

```bash
  $ git tag 4.95.0-this-is-an-example
  $ git push upstream 4.95.0-this-is-an-example
```

```bash
  $ git tag -d 4.95.0-this-is-an-example
  $ git push upstream :4.95.0-this-is-an-example
```

--------------------------------

### List IPv4 Network Files for a Specific PID (Ignoring Errors)

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

This command lists IPv4 network files for a PID, ignoring errors if the PID or its files are not found. The -Q option suppresses error messages for missing items.

```bash
lsof -Q -i 4 -a -p 1234
```

--------------------------------

### List All Open Files

Source: https://context7.com/lsof-org/lsof/llms.txt

Without options, lsof lists every open file for all active processes. Output includes command, PID, user, file descriptor, type, device, size/offset, node, and name.

```shell
$ lsof
COMMAND     PID   USER   FD   TYPE DEVICE  SIZE/OFF     NODE NAME
systemd       1   root  cwd    DIR    8,1      4096        2 /
systemd       1   root  txt    REG    8,1   1620224   655844 /usr/lib/systemd/systemd
sshd        987   root    3u  IPv4  22365       0t0      TCP *:ssh (LISTEN)
sshd        987   root    4u  IPv6  22366       0t0      TCP *:ssh (LISTEN)
bash       2301   abe   cwd    DIR    8,1      4096  1835009 /home/abe
bash       2301   abe     0u   CHR  136,3       0t0        6 /dev/pts/3
```

--------------------------------

### AND Selection with -a

Source: https://context7.com/lsof-org/lsof/llms.txt

Use the -a flag to combine multiple selection options with a logical AND, ensuring results match all specified criteria. By default, options are OR'd.

```shell
# Files belonging to PID 1234 AND owned by UID 5678
$ lsof -p 1234 -a -u 5678

# UNIX sockets belonging to user foo only
$ lsof -u foo -a -U

# cwd files for process group 12717
$ lsof -g12717 -adcwd
COMMAND   PID  PGID USER  FD TYPE DEVICE SIZE/OFF    NODE NAME
sshd    11369 12717 root cwd VDIR    0,2      189 1449175 /tmp (swap)
sshd    12717 12717 root cwd VDIR  136,0     1024       2 /

```

--------------------------------

### List Specific File Descriptors for a Command

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

This command lists files at specified descriptors (e.g., 1 and 3) for processes running a particular command (e.g., 'lsof') owned by a specific login ID ('abe'), with a repeat interval of 10 seconds.

```bash
lsof -c lsof -a -d 1 -d 3 -u abe -r10
```

--------------------------------

### Take Action on Open Files

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

This command lists open files and can be used in conjunction with shell commands to take action if a file is found to be in use.

```bash
lsof /u/abe/foo  echo "still in use"
```

--------------------------------

### Display only portmap registrations with combined options

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

A more concise version of the previous command, combining the -i and +M options and using grep to filter for portmap registrations.

```bash
$ lsof +Mi | grep "["
```

--------------------------------

### List Devices Recursively

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Use 'ls -R' to recursively list the contents of /dev or /devices. This can help diagnose if the file system tree itself is causing hangs, which would also affect lsof.

```shell
$ ls -R /dev
```

```shell
$ ls -R /devices
```

--------------------------------

### Format C Sources with clang-format

Source: https://github.com/lsof-org/lsof/blob/master/docs/contributing.md

Use clang-format to automatically format C source files. This ensures consistent code style across the project. Run this command in your terminal.

```shell
clang-format -i lib/dialcets/linux/dsock.c
```

```shell
git-clang-format
```

--------------------------------

### Obtain Detailed Output Fields

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

The -F option allows you to specify the output fields to be displayed, such as PID, command name, file descriptor, device number, and inode number.

```bash
lsof -FpcfDi
```

--------------------------------

### Select Files by Command Name with -c

Source: https://github.com/lsof-org/lsof/blob/master/docs/options.md

List files associated with processes matching a specific command name. Multiple -c options can be used to specify multiple command names.

```bash
$ lsof -clsof -cksh
```

--------------------------------

### Run LTbigf test with large file support on AIX

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Use the -p option to specify a path to a file system enabled for large file operations when the default location is not suitable. Ensure the ulimit file block size permits writing a large file.

```shell
$ ./LTbigf -p /scratch23/abe/bigfile
```

--------------------------------

### Search an NFS file system by server and mount point with lsof

Source: https://github.com/lsof-org/lsof/blob/master/docs/faq.md

Use the +f option with server and mount point details to search for an NFS file system. This requires the mount application to report the NFS details in this format.

```bash
$ lsof +f -- fleet:/home/fleet/u5

```

--------------------------------

### Find Process with Specific File Open (Quiet)

Source: https://github.com/lsof-org/lsof/blob/master/docs/manpage.md

Use the -Q option to find a process that has a specific file open, without generating output if no such process exists.

```bash
lsof -Q /u/abe/foo
```