Identify Open Files by a Process
In this step, you will learn how to use the lsof
command to identify the open files associated with a specific process.
Let's start by finding the process ID (PID) of a running process. You can use the ps
command for this:
sudo ps -ef | grep nginx
Example output:
root 825 1 0 14:32 ? 00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 826 825 0 14:32 ? 00:00:00 nginx: worker process
www-data 827 825 0 14:32 ? 00:00:00 nginx: worker process
In this example, the nginx
process has a PID of 825.
Now, you can use the lsof
command to list all the open files associated with this process:
sudo lsof -p 825
Example output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 825 root cwd DIR 253,0 4096 1048576 /usr/sbin
nginx 825 root rtd DIR 253,0 4096 2 /
nginx 825 root txt REG 253,0 977528 1048577 /usr/sbin/nginx
nginx 825 root mem REG 253,0 2067688 1048578 /usr/lib/x86_64-linux-gnu/libc-2.35.so
nginx 825 root mem REG 253,0 169032 1048579 /usr/lib/x86_64-linux-gnu/ld-2.35.so
nginx 825 root 0u CHR 136,0 0t0 3 /dev/pts/0
nginx 825 root 1u CHR 136,0 0t0 3 /dev/pts/0
nginx 825 root 2u CHR 136,0 0t0 3 /dev/pts/0
This output shows all the open files associated with the nginx
process, including the executable file, shared libraries, and the standard input/output/error file descriptors.
You can also use the lsof
command to find open files by a specific user. For example, to find all the open files owned by the labex
user:
sudo lsof -u labex
This can be useful for troubleshooting issues or understanding the activity of a specific user on the system.
In the next step, you will learn how to use the lsof
command to locate network connections.