Seeing What Linux Has Open with lsof

lsof gives administrators a live view of the open files and active network connections held by each process. The tool reports file descriptors rather than only process names, so a busy web service, database, or SSH daemon can be examined without attaching a debugger.

On modern Linux, sockets are also files. That common design means one command can reveal regular files, pipes, Unix domain sockets, TCP listeners, and UDP endpoints. It is particularly useful when a port is occupied but the owning process is unclear.

The safest mental model is to treat lsof as a snapshot, not a verdict. The output reflects the moment of execution, permissions affect what can be seen, and containers introduce separate PID and network namespaces.

For administrators working across Sydney, Melbourne, and regional offices, this matters when a local service must be distinguished from a remote dependency. It also helps separate an application problem from the NBN router, carrier-grade NAT, or an upstream firewall without changing the server first.

Install lsof and run a first check

On RHEL, CentOS Stream, and Fedora, install the package with sudo dnf install lsof; older CentOS systems use sudo yum install lsof. If the configured repositories do not contain it, use the organisation's approved EPEL or vendor repository rather than downloading an arbitrary binary.

After installation, confirm the available version with lsof -v, then run sudo lsof -nP -i. The -n option prevents reverse DNS lookups, while -P keeps port numbers visible instead of converting them to service names. Both flags usually make network output faster and easier to scan.

Commands such as ss, fuser, and netstat answer related but different questions. The site's Linux command reference provides a convenient place to compare them with lsof filters.

Understand the important output columns

A typical row starts with COMMAND, PID, USER, and FD. The command name identifies the process, the PID identifies the kernel process, the user shows its owner, and the file-descriptor column uses values such as cwd, txt, rtd, and numeric entries for open descriptors. The TYPE column distinguishes items such as REG, IPv4, IPv6, unix, and PIPE.

For regular files, SIZE/OFF may show the apparent size or offset. The NODE field identifies the filesystem object, while NAME contains the path or network endpoint. Network rows often append a state such as LISTEN or ESTABLISHED, so read the whole row rather than matching only the port.

Use sudo where exact ownership matters. Without elevated privileges, many system-owned sockets and files may be omitted, producing a misleadingly short result.

Filter sockets by port and state

Start with a precise port and protocol, then add a state when useful. For example, sudo lsof -nP -iTCP:443 -sTCP:LISTEN finds HTTPS listeners, while sudo lsof -nP -iUDP:53 shows processes holding DNS-related UDP endpoints. Restricting both protocol and state avoids mixing unrelated IPv4, IPv6, TCP, and UDP records.

To compare a server with a controlled endpoint, an isolated virtual machine from a provider offering managed Linux hosting can help reveal whether behaviour belongs to the application or the network path. Test only with systems you are authorised to probe, and remember that public IP visibility can end at Australian carrier-grade NAT rather than the virtual machine itself.

Fast checks for common incidents

These compact filters cover many first checks in an incident. Replace the example PID with the value shown by your own process or service lookup.

Connection checks

• Use sudo lsof -nP -iTCP:443 -sTCP:LISTEN to find the process listening on HTTPS.
• Use sudo lsof -nP -iUDP:53 to inspect DNS-related UDP endpoints.
• Use sudo lsof -nP -iTCP -sTCP:ESTABLISHED to review active TCP sessions.

Process and file checks

• Use sudo lsof -nP -p 1234 to list descriptors held by one PID.
• Use sudo lsof -nP -u nginx to inspect files opened by the Nginx user.
• Use sudo lsof /var/log/nginx/access.log to check whether Nginx has that log open.

For directories, sudo lsof +D /path recursively searches open files beneath a path, but it can be slow on large trees. sudo lsof +L1 is useful for finding deleted files that remain referenced by a running process.

Trace Nginx and sensitive log files

Nginx may have a master process and several workers, so identify which PID owns the listening socket before inspecting individual workers. Pair the result with sudo systemctl status nginx, sudo nginx -t, and sudo journalctl -u nginx --since "30 minutes ago". A configuration test confirms syntax and file references; it does not prove that a worker successfully opened every log.

Australian fintech and ecommerce operators often use Nginx as the public gateway for applications hosted in Australian regions. Open access logs can contain IP addresses, URLs, account identifiers, or tokens in poorly designed query strings. For covered businesses, the Privacy Act 1988, Australian Privacy Principles, and Notifiable Data Breaches scheme make sensitive logs a controlled record. Limit who can run privileged inspection commands, and avoid pasting unrestricted sudo lsof output into tickets or chat.

Use findings safely in a repeatable workflow

Correlate the PID with ps -fp 1234, the executable shown by readlink /proc/1234/exe, and its control group under /proc/1234/cgroup. The executable and control-group details help distinguish a host service from a container process, whose visible sockets may differ because of network namespaces.

Do not kill a PID merely because it owns a socket. Check the unit, validate the configuration, and use systemctl reload nginx or an appropriate service restart when a change is required. Compare lsof with ss and recent logs, since lsof provides an instantaneous view and another process may bind the port immediately after it exits.

The practical takeaway is to begin with sudo lsof -nP -i, narrow by protocol, port, PID, or user, then verify ownership and service state before taking action.