Software >> OS >> Unix >> Linux >> commands >> lsof >> How to use lsof to identify process or processes accessing a file or filesystem

(1) e.g. List the process(es) that is(are) accessing a file


# lsof -f -- /usr/sbin/httpd
COMMAND   PID   USER  FD   TYPE DEVICE SIZE/OFF   NODE NAME
httpd    2779   root txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77290 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77291 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77292 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77293 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77294 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77295 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77296 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd
httpd   77297 apache txt    REG  253,0   354816 560817 /usr/sbin/httpd

-f => the argument that follows is file name or file path

 

(2) e.g. list process(es) that is accessing a file system


# lsof +f -- /var/log
COMMAND     PID   USER   FD   TYPE DEVICE  SIZE/OFF   NODE NAME
rsyslogd   1857   root    1w   REG  253,6      3275  40978 /var/log/messages
rsyslogd   1857   root    2w   REG  253,6     56974  40976 /var/log/cron
rsyslogd   1857   root    4w   REG  253,6      5847  40979 /var/log/secure
mcelog     2282   root    3w   REG  253,6         0     31 /var/log/mcelog
abrt-dump  2492   root    4r   REG  253,6      3275  40978 /var/log/messages
httpd      2779   root    2w   REG  253,6       245 155654 /var/log/httpd/error_log
httpd      2779   root    5w   REG  253,6 116277457     32 /var/log/modsec_audit.log
httpd      2779   root   12w   REG  253,6     77964 155652 /var/log/httpd/access_log
httpd     77297 apache    5w   REG  253,6 116277457     32 /var/log/modsec_audit.log
httpd     77297 apache   12w   REG  253,6     77964 155652 /var/log/httpd/access_log

+f => the argument is treated as file system

where /var/log is one of the filesystems mounted

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg00-lvroot
                       15G  8.0G  5.6G  59% /
tmpfs                 1.9G   12K  1.9G   1% /dev/shm
/dev/sda1             504M  103M  377M  22% /boot
/dev/mapper/vg00-lvhome
                     1008M   56M  902M   6% /home
/dev/mapper/vg00-lvtmp
                      5.0G  2.8G  1.9G  60% /tmp
/dev/mapper/vg00-lvvar
                      9.9G  1.4G  8.0G  15% /var
/dev/mapper/vg00-lvvarlog
                      9.9G  2.5G  7.0G  27% /var/log
/dev/mapper/vg00-lvaudit
                      5.0G  2.3G  2.4G  50% /var/log/audit
/dev/mapper/VGnpb-LVapps
                       49G   34G   13G  74% /apps