Both Linux and Unix-like operating systems come with various utilities to find out open files associated with the process.
UNIX List Open Files For Process
First use the ps command command to get PID of process, enter:
$ ps -aef | grep {process-name}
$ ps -aef | grep httpd
Next pass this PID to pfiles command,
$ pfiles {PID}
$ pfiles 3533
See pfiles command documentation for more information
FreeBSD list open files per process
On FreeBSD use the fstat command along with the ps command:
# ps aux | grep -i openvpn # filter outputs using the grep command #
# fstat -p {PID}
# fstat -p 1219
We can count open files count for openvpn process as follows using the wc command:
# fstat -p 1219 | grep -v ^USER | wc -l
The -p option passed to the fstat to report all files open by the specified process.
FreeBSD pstat command in action
Linux List Open Files For Process
First you need to find out PID of process. Simply use any one of the following command to obtain process id:
# ps aux | grep {program-name}
OR
$ ps -C {program-name} -o pid=
For example, find out PID of firefox web-browser, enter:
$ ps -C firefox -o pid=
Output:
7857
To list opne files for firefox process, enter:
$ ls -l /proc/7857/fd
Sample output:
total 0 lr-x------ 1 vivek vivek 64 2008-03-05 22:31 0 -> /dev/null l-wx------ 1 vivek vivek 64 2008-03-05 22:31 1 -> pipe:[18371] lr-x------ 1 vivek vivek 64 2008-03-05 22:31 10 -> /usr/lib/firefox/firefox l-wx------ 1 vivek vivek 64 2008-03-05 22:31 2 -> pipe:[18371]
For privileged process use the sudo command and to count open files use the wc command on Linux as follows:
# Get process pid
sudo ps -C Xorg -o pid
sudo ls -l /proc/${pid-here}/fd
# Say pid is 9497 for Xorg, then
sudo ls -l /proc/9497/fd | wc -l
We can use bash for loop as follows too:
# Linux Count and List Open Files for Nginx Process # SEARCH="nginx" for i in $(ps -C "${SEARCH}" -o pid | grep -v PID) do echo "PID # ${i} open files count : $(sudo ls -l /proc/${i}/fd | wc -l)" done
Listing Open Files on Linux
Using lsof to display the processes using the most file handles
The lsof command list open files under all Linux distributions or UNIX-like operating system. Type the following command to list open file for process ID 351:
$ lsof -p 351
In this example display and count all open files for top 10 processes on Linux operating systems or server:
# lsof | awk '{print $1}' | sort | uniq -c | sort -r | head
## force numeric sort by passing the '-n' option to the sort ##
# lsof | awk '{print $1}' | sort | uniq -c | sort -r -n | head
3884 nginx 643 php-fpm7. 370 memcached 90 rsyslogd 81 systemd 63 systemd-j 58 systemd-r 55 systemd-n 50 systemd-l 48 networkd-
Where,
- lsof – Run the lsof to display all open files and send output to the awk
- awk '{print $1}' – Display first field i.e. process name only
- uniq -c – Omit duplicate lines while prefix lines by the number of occurrences
- sort -r – Reverse sort
- head – Display top 10 process along with open files count
Conclusion
Now you know how to find open files per process on Linux, FreeBSD, and Unix-like systems using various command-line options. See how to increase the system-wide/user-wide number of available (open) file handles on Linux for more information.
🐧 Get the latest tutorials on Linux, Open Source & DevOps via:
- RSS feed or Weekly email newsletter
- Share on Twitter • Facebook • 22 comments... add one ↓
Category | List of Unix and Linux commands |
---|---|
File Management | cat |
Firewall | Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04 |
Network Utilities | dig • host • ip • nmap |
OpenVPN | CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04 |
Package Manager | apk • apt |
Processes Management | bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time |
Searching | grep • whereis • which |
User Information | groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w |
WireGuard VPN | Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04 |
Here is a cool lsof trick that shows you what port is in use by which program:
lsof -iTCP:80
lsof -p `ps -C firefox -o pid=`
in a single line
For the single line lovers, here is another:
lsof -p `pgrep firefox-bin`
pgrep could be not automatically installed by your distro.
Hi,,,, lsof is not giving the results in my Linux server,
whenever i give the command ” lsof -u OSuser|wc -l ” its gives error saying “command not found”
Install lsof package.
Use the netstat as follows
netstat -vatupn
How can i see all files that opened by a specific pid and all it’s threads.
My C++ program opens 200 threads per process but i do not see all file descriptors that were opened by each thread.
Hi there,
Is it possible to do it in the opposite direction. How to know which process created a particular file?
I’ve just discovered your site, thanks a lot for sharing so much good stuff.
Javier.
It is possible to see which process has a particular file open using fuser.
you could just use lsof like this.
lsof | grep path/to/filename.
I’m afraid there are no way to get process which created file. :(
What a pity! Thks for your help man.
javier:
>>> Is it possible to do it in the opposite direction. How to know which process created a particular file?
if the file is open try
fuser
‘fuser -m‘ (or . in case file is not accessible) will return all processes that have locked this file (or directory in case file is not accessible) then proceed as suggested with lsof -p | grep
What is man difference between lsof & pmap?
Oneliner for Linux ; )
lsof -p $(ps -ef | grep [PROGRAM_NAME] | grep -v grep | awk '{print $2}')
How could you get the files opened by a process using kernel modules?
I mean, what would be the corespondent for ps aux | grep ?
10x
simpler way..
it doesn’t works when i try to do ‘lsof -p ‘ and got message as below
/opt/csw/bin/lsof -p 22982
lsof: can’t stat(/devices): No such file or directory
I am using weblogic osb in red hat linux system,and the command pfiles is not found.
My aim is to find File Descriptor’s total capacity
command which i am running is:
procfiles | grep rlimit
Please help.
My server doesn’t have lsof installed.
This works for me though:
ls -l /proc/*/fd | grep
Yeah… lsof comes from something that used to be called ‘ofiles’ I think…. Hit nothing searching for ‘ofiles’ so I’m including this comment ! ;)