Discover which process keeps files or sockets open and act on them quickly. 05.01.2026 | reading time: 2 min A log rotation fails because the file is still in use. lsof shows which process keeps that file open so the admin can act; it inspects open files, pipes and network sockets across the system and makes the problem visible. A stuck log file Reproduce the situation and resolve it with lsof. ```bash $ sudo lsof /var/log/nginx/access.log COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1234 www-data 4w REG 8,1 2048000 12345 /var/log/nginx/access.log ``` The output tells the admin the command, PID and file descriptor that holds the file; to release it he may restart or signal the process, for example `sudo kill -HUP 1234` to ask nginx to reopen its logs. Beyond a single filename Use filters to focus the output: list network sockets, inspect a given PID, or show files opened by a user; add `-nP` to avoid DNS and port-name lookups when speed and clarity matter; note that `+D` recursively walks directories and can be slow on large trees, so prefer targeted queries when possible. Tools that pair well with lsof Combine lsof with quick checks of `/proc/PID/fd` to see actual symlink targets, use `fuser` to send signals to processes by file, and consult `ss` for a compact view of sockets; lsof gives a broad, human-readable inventory while these tools cover narrower follow-up actions. Wrap-up and next moves Use lsof as a first step whenever a file is unexpectedly busy or a port is claimed; it turns hidden kernel state into actionable information and shortens troubleshooting loops. Keep practicing, explore related commands and consider formal certification like CompTIA Linux+ or LPIC-1 with intensive exam preparation at bitsandbytes.academy to deepen system-level skills. Join Bits & Bytes Academy First class LINUX exam preparation. utilities filesystem processes troubleshooting
