In this section, we will explore different options that can be used with the lsof command to understand how it works:

1. If we just run lsof, it will list all of the open files that belong to any active process on the system. If the output is long, we can use the less command to scroll through the output:

    lsof | less

The output which is displayed in the preceding screenshot is shown in columns such as Command, PID, User, FD, Type, Device, and so on, for a better understanding about the files.

The FD column has information about the file's description, such as the Current Working Directory (CWD), Root Directory (RTD), Program Text (TXT), and so on. If the FD column contains information like 0u, 1u, and so on, the number signifies the actual file descriptor and the alphabet signifies the different modes (read access, write access, and read/write access).

1. To check the list of all open files for a particular user, we can use the -u option followed by the username, as follows:

    lsof -u tajinder

2. Using lsof, we can check if there are any processes running on a particular port. To do so, we have to use the -i option and run the following command:

    lsof -i TCP:22

In the preceding example, we have checked for the list of running processes on port 22, and we can see that the SSH process is running.

1. If we want to check the exact number of open files on the system, we can run the following command:

In the preceding example, we can see that we have lots of open files— 5,220 to be specific.

1. To check which user is looking at what files and which commands are being run by the user, we can use the following command:

    lsof -i -u tajinder

We have many more options while using lsof, which can be explored by referring to the main page of the lsof command.