Practical Linux Security Cookbook

Using system tools – lsof

At times, we may face situations where we are unable to unmount a disk due to the fact that some files are being used. However, we may not be able to understand which file is being referred to. In such situations, we can check which files are being opened by which processes running on the system.

This can be done using the lsof command, which stands for List Open Files. Since Linux considers everything, such as directories, devices, sockets, and so on, as a file, we can use lsof to easily identify all the open files.

Getting ready

To use the lsof command, it is recommended that you are logged in from root account, or else, use sudo from a nonroot account so that the output of the lsof command is not limited.

How to do it… ...