See which processes hold files, sockets or ports and act on them quickly. 07.04.2026 | reading time: 2 min Who holds a file open, or which process listens on a socket? The command `lsof` lists every open file and network connection on a Linux system, making resource-hungry processes and hidden file handles visible. Find the process holding a port Try this live: run ```bash sudo lsof -iTCP:8080 -sTCP:LISTEN -Pn COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 4321 tomcat 45u IPv6 0x12345678 0t0 TCP *:8080 (LISTEN) ``` Here PID 4321 is the listener; to stop it run `sudo kill 4321` or restart the relevant service. Recover disk space from deleted files Disk full but no big files show up? Find deleted files still held by processes with ```bash sudo lsof +L1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME mysqld 2345 mysql 12u REG 8,1 524288 0 12345 /var/lib/mysql/ibdata1 (deleted) ``` Restarting the owning service frees the space without hunting for invisible files. Filters, options and caveats `lsof` offers many filters: `-p` for PID, `-u` for user, `-c` for command, `-i` for network, `+D` to search a directory tree, `-t` for PIDs only and `-nP` to skip name resolution; run with `sudo` to see all processes and beware that recursive scans like `+D /` can be slow on large filesystems. When lsof is not enough Use `lsof` to find the process, then combine it with other tools to act: `kill` to terminate, `systemctl` to restart services, or `strace` to trace file activity; remember `lsof` reports what the kernel exposes, so kernel bugs or containers may require additional inspection tools. Where to go next Mastering `lsof` turns mystery disk usage and mysterious open sockets into actionable items; explore related tools and consider deepening Linux skills through certifications like CompTIA Linux+ or LPIC-1 and intensive exam preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. filesystem processes network utilities security troubleshooting
