Glossary/When something goes wrong
lsof
Also: list open files
Quick answer
lsof is a Terminal command that lists the files, folders and network connections every process has open. On a Mac it answers which process is using a file, what is keeping a disk from ejecting and what is listening on a port.
lsof stands for list open files, and it comes with macOS. Run with nothing after it, it prints thousands of lines, one per open file, so it is almost always given a file, a folder, a disk or a port to narrow the list.
Without sudo it shows only your own processes. With it, macOS's own are included, such as Spotlight's.
The lsof commands worth knowing
Each one takes a path, a port or a process to narrow the list.
lsof /path/to/file: what has this file opensudo lsof /Volumes/NAME: everything open on a disklsof +D /path/to/folder: everything open inside a folderlsof -nP -iTCP:3000 -sTCP:LISTEN: what is listening on port 3000lsof -p <PID>: every file one process has open
How to read the output
COMMAND is the process name, cut to nine letters, PID its number and USER who runs it. FD says how the file is open: a number with r for reading, w for writing or u for both, cwd for the folder the process works in and txt for the program and the libraries it loaded. NAME is the path, or the network address.
Why lsof is slow, or prints warnings
Looking inside a large folder with +D reads every file under it and can take minutes. Warnings about files it cannot read are normal without sudo.
Questions people ask
What does lsof stand for?
List open files.
Is lsof installed on a Mac?
Yes. It comes with macOS, at /usr/sbin/lsof.
Why does lsof show nothing?
Nothing of yours has the file open. Run it with sudo to include the processes macOS and other users run.
Related
Step by step: Disk won’t eject.
Looking for something better than Activity Monitor? See the best Activity Monitor alternatives for Mac, or browse every term in the glossary.