Identifying processes using specific files or ports in Linux and macOS
In Linux/Unix everything is considered as a file. This includes not only files like documents and images but also directories, devices, etc.. This approach allows using the same set of tools for various types of resources.
From time to time when trying to manipulate a file or open a port I get an error with the information that it's already being used. To find out which process uses a file/port I use lsof, a very useful tool for diagnostics, system and network security, and system administration. lsof stands for "list open files".
In this post output examples are from macOS. They may look slightly different on your OS, but the general idea is the same.
Listing opened files
To get a list of all opened files use it directly:
lsof
Example output from my mac:
❯ lsof
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
loginwind 392 piotrpliszko cwd DIR 1,15 640 2 /
loginwind 392 piotrpliszko txt REG 1,15 2721512 1152421500612773740 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
loginwind 392 piotrpliszko txt REG 1,15 120 1152221500412130454 /System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings
loginwind 392 piotrpliszko txt REG 1,15 134016 1151921561312130169 /System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/SystemAppearance.car
loginwind 392 piotrpliszko txt REG 1,15 193280 1152921100316231719 /System/Library/LoginPlugins/FSDisconnect.loginPlugin/Contents/MacOS/FSDisconnect
loginwind 392 piotrpliszko txt REG 1,15 305280 1152921560383031672 /System/Library/LoginPlugins/DisplayServices.loginPlugin/Contents/MacOS/DisplayServices
# ...
Expect a very long output - it will list everything that is opened in the whole system. It's usually not something we are interested in when exploring a list manually, so if you want to filter out files opened by specific user, use:
lsof -u <username>
If you want to look for a specific file you can either provide a path to the file or just grep an output. Here is an example:
❯ lsof /Users/piotrpliszko/Downloads/contacts.csv
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Code 59354 piotrpliszko 27r REG 1,15 1771 58954315 /Users/piotrpliszko/Downloads/contacts.csv
❯ lsof | grep contacts.csv
Code 59354 piotrpliszko 27r REG 1,15 1771 58954315 /Users/piotrpliszko/Downloads/contacts.csv
Finding process using specified port
Sometimes you try to start something, for example a dev server, and you are greeted with a not-so-nice "the port is already in use" message. It's fine if you can just kill the other process, but what about a situation where you already tried shutting it down and it's still in use? Or what about a situation where you are not aware which process can possibly use the selected port? lsof will help us to figure out which process is responsible for this.
To list all current network connections:
lsof -i
To find process using a specific port use
lsof -i <type>:<portnumber>
for example, let's say I want to know which process uses port 4772:
❯ lsof -i TCP:4772
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
node 87358 piotrpliszko 20u IPv6 0x9e3db08c81e3cd1e 0t0 TCP *:4772 (LISTEN)
I can see that it's a node server, which I can kill using kill command
❯ kill 87358
~
# let's check if it's still in use
❯ lsof -i TCP:4772
~
# nothing found!
Listing all files opened by process
To further inspect a process, you may want to list all files opened by it. It will of course include all network connections too. To do so, use:
lsof -p <PID>