Linux / UNIX List Open Files for Process

How do I list all open files for a Linux or UNIX process using command line options? How can I show open files per process under Linux?

Both Linux and Unix-like operating systems come with various utilities to find out open files associated with the process.

ADVERTISEMENTS

UNIX List Open Files For Process

First use the ps command command to get PID of process, enter:
$ ps -aef | grep {process-name}
$ ps -aef | grep httpd

Next pass this PID to pfiles command,
$ pfiles {PID}
$ pfiles 3533

See pfiles command documentation for more information

FreeBSD list open files per process

On FreeBSD use the fstat command along with the ps command:
# ps aux | grep -i openvpn # filter outputs using the grep command #
# fstat -p {PID}
# fstat -p 1219

We can count open files count for openvpn process as follows using the wc command:
# fstat -p 1219 | grep -v ^USER | wc -l
The -p option passed to the fstat to report all files open by the specified process.

FreeBSD show open files per process command

FreeBSD pstat command in action

Linux List Open Files For Process

First you need to find out PID of process. Simply use any one of the following command to obtain process id:
# ps aux | grep {program-name}
OR
$ ps -C {program-name} -o pid=
For example, find out PID of firefox web-browser, enter:
$ ps -C firefox -o pid=
Output:

 7857

To list opne files for firefox process, enter:
$ ls -l /proc/7857/fd
Sample output:

total 0
lr-x------ 1 vivek vivek 64 2008-03-05 22:31 0 -> /dev/null
l-wx------ 1 vivek vivek 64 2008-03-05 22:31 1 -> pipe:[18371]
lr-x------ 1 vivek vivek 64 2008-03-05 22:31 10 -> /usr/lib/firefox/firefox
l-wx------ 1 vivek vivek 64 2008-03-05 22:31 2 -> pipe:[18371]

For privileged process use the sudo command and to count open files use the wc command on Linux as follows:
# Get process pid
sudo ps -C Xorg -o pid
sudo ls -l /proc/${pid-here}/fd
# Say pid is 9497 for Xorg, then
sudo ls -l /proc/9497/fd | wc -l

We can use bash for loop as follows too:

# Linux Count and List Open Files for Nginx Process #
SEARCH="nginx"
for i in $(ps -C "${SEARCH}" -o pid | grep -v PID)
do  
     echo "PID # ${i} open files count : $(sudo ls -l /proc/${i}/fd | wc -l)"
done
Ubuntu Linux List Open Files for Process Bash Command

Listing Open Files on Linux

Using lsof to display the processes using the most file handles

The lsof command list open files under all Linux distributions or UNIX-like operating system. Type the following command to list open file for process ID 351:
$ lsof -p 351
In this example display and count all open files for top 10 processes on Linux operating systems or server:
# lsof | awk '{print $1}' | sort | uniq -c | sort -r | head
## force numeric sort by passing the '-n' option to the sort ##
# lsof | awk '{print $1}' | sort | uniq -c | sort -r -n | head

   3884 nginx
    643 php-fpm7.
    370 memcached
     90 rsyslogd
     81 systemd
     63 systemd-j
     58 systemd-r
     55 systemd-n
     50 systemd-l
     48 networkd-

Where,

  • lsof – Run the lsof to display all open files and send output to the awk
  • awk '{print $1}' – Display first field i.e. process name only
  • uniq -c – Omit duplicate lines while prefix lines by the number of occurrences
  • sort -r – Reverse sort
  • head – Display top 10 process along with open files count

Conclusion

Now you know how to find open files per process on Linux, FreeBSD, and Unix-like systems using various command-line options. See how to increase the system-wide/user-wide number of available (open) file handles on Linux for more information.

🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallCentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNCentOS 8 Debian 10 Firewall Ubuntu 20.04

ADVERTISEMENTS
22 comments… add one
  • Robert de Bock Mar 5, 2008 @ 17:22

    Here is a cool lsof trick that shows you what port is in use by which program:

    lsof -iTCP:80

  • Eduardo García Mar 5, 2008 @ 18:50

    lsof -p `ps -C firefox -o pid=`
    in a single line

  • Marco Apr 20, 2008 @ 14:57

    For the single line lovers, here is another:

    lsof -p `pgrep firefox-bin`

    pgrep could be not automatically installed by your distro.

  • abhi Jul 14, 2009 @ 5:07

    Hi,,,, lsof is not giving the results in my Linux server,
    whenever i give the command ” lsof -u OSuser|wc -l ” its gives error saying “command not found”

  • kolmisoft Sep 13, 2009 @ 11:00

    Use the netstat as follows
    netstat -vatupn

  • eldar52 Nov 23, 2009 @ 7:49

    How can i see all files that opened by a specific pid and all it’s threads.
    My C++ program opens 200 threads per process but i do not see all file descriptors that were opened by each thread.

  • javier Dec 4, 2009 @ 11:16

    Hi there,

    Is it possible to do it in the opposite direction. How to know which process created a particular file?

    I’ve just discovered your site, thanks a lot for sharing so much good stuff.

    Javier.

    • Sambodhi Sep 21, 2015 @ 13:25

      It is possible to see which process has a particular file open using fuser.

      • Hergeir Jul 14, 2017 @ 22:24

        you could just use lsof like this.

        lsof | grep path/to/filename.

  • kandrewo Dec 18, 2009 @ 15:25

    I’m afraid there are no way to get process which created file. :(

  • Javier Dec 21, 2009 @ 17:31

    What a pity! Thks for your help man.

  • shiprat Apr 7, 2010 @ 4:42

    javier:
    >>> Is it possible to do it in the opposite direction. How to know which process created a particular file?

    if the file is open try
    fuser

  • Elijah Saounkine Jun 9, 2010 @ 12:12

    fuser -m‘ (or . in case file is not accessible) will return all processes that have locked this file (or directory in case file is not accessible) then proceed as suggested with lsof -p | grep

  • Nafasat Apr 15, 2011 @ 15:02

    What is man difference between lsof & pmap?

  • omfg Apr 2, 2012 @ 8:29

    Oneliner for Linux ; )
    lsof -p $(ps -ef | grep [PROGRAM_NAME] | grep -v grep | awk '{print $2}')

  • ica May 4, 2012 @ 16:48

    How could you get the files opened by a process using kernel modules?
    I mean, what would be the corespondent for ps aux | grep ?

    10x

  • Kiswono Jul 11, 2012 @ 2:53

    simpler way..

    lsof -c firefox
  • Jane Aug 23, 2012 @ 18:45

    it doesn’t works when i try to do ‘lsof -p ‘ and got message as below
    /opt/csw/bin/lsof -p 22982
    lsof: can’t stat(/devices): No such file or directory

  • spb Dec 6, 2012 @ 19:35

    I am using weblogic osb in red hat linux system,and the command pfiles is not found.
    My aim is to find File Descriptor’s total capacity

    command which i am running is:
    procfiles | grep rlimit

    Please help.

  • paulvc Apr 23, 2013 @ 1:06

    My server doesn’t have lsof installed.

    This works for me though:

    ls -l /proc/*/fd | grep

  • winky Apr 29, 2013 @ 5:29

    Yeah… lsof comes from something that used to be called ‘ofiles’ I think…. Hit nothing searching for ‘ofiles’ so I’m including this comment ! ;)

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.