Linux: How to find files open by a Linux process (lsof)

Linux process question: How can I determine which files are open by a process on a Unix/Linux system?

It seems like a couple of times a year I run into a situation where I have a zombie process that I need to get rid of, but before killing it off, I want to make sure I’m killing the right thing. Sometimes when a Linux process is in a zombie state, you can’t see the information you need with the ps command, so you need something else.

Solution: Linux `lsof` command: list open process files

That’s where the lsof command comes in. The lsof (“list open files”) command can be used to list files that are opened by a specified Linux process. Just use it with the -p option and a process id (PID) to get the listing:

lsof -p [pid]

Note that there may be some behavioral differences here depending on whether you are logged in as root or as another user. I assume that this mostly has to do with security, i.e., what you can see when you are root should differ from what you can see as another user.

lsof example

Here’s an example of how to use the lsof command to list the open files for a given Linux process:

lsof -p 19777

where 19777 is the pid of the process I want to get more information about. This command will create a list of all Unix/Linux processes on your system related to that process id.