Using lsof on macOS#

lsof stands for “list open files”. Here are some very basic usage notes for the version that ships with macOS.

Listing processes that have a specific file open#

1
~ % lsof /tmp/covid-smaller.db
2
COMMAND   PID  USER   FD   TYPE DEVICE  SIZE/OFF      NODE NAME
3
Python  17990 simon    6r   REG    1,5 747413504 187550734 /private/tmp/covid-smaller.db
4
Python  17990 simon   12r   REG    1,5 747413504 187550734 /private/tmp/covid-smaller.db

Note that this file is opened twice by the same process (Datasette maintains multiple connections to the same SQLite database). The PID column is useful.

In the FD column 6r means “file descriptor 6, open for read access”. w would mean write access, u would mean both.

Files for a specific process#

I removed some of the output here trying to leave the most interesting bits:

1
~ % lsof -p 17990
2
COMMAND   PID  USER   FD     TYPE             DEVICE  SIZE/OFF                NODE NAME
3
Python  17990 simon  cwd      DIR                1,5      1344           174186151 /private/tmp
4
Python  17990 simon  txt      REG                1,5     49400           163507251 /usr/local/Cellar/python@3.9/3.9.7/Frameworks/Python.framework/Versions/3.9/Resources/Python.app/Contents/MacOS/Python
5
Python  17990 simon  txt      REG                1,5   3632512           163507083 /usr/local/Cellar/python@3.9/3.9.7/Frameworks/Python.framework/Versions/3.9/Python
6
...
7
Python  17990 simon  txt      REG                1,5     50840           152019254 /usr/local/Cellar/datasette/0.58.1/libexec/lib/python3.9/site-packages/markupsafe/_speedups.cpython-39-darwin.so
8
...
9
Python  17990 simon  txt      REG                1,5   1069536           148927587 /usr/local/Cellar/sqlite/3.36.0/lib/libsqlite3.0.dylib
10
Python  17990 simon  txt      REG                1,5     24552           179047672 /usr/local/Cellar/datasette/0.58.1/libexec/lib/python3.9/site-packages/bpylist/bplist.cpython-39-darwin.so
11
Python  17990 simon  txt      REG                1,5   1572480 1152921500312757159 /usr/lib/dyld
12
Python  17990 simon    0u     CHR               16,5   0t94656                6931 /dev/ttys005
13
Python  17990 simon    1u     CHR               16,5   0t94656                6931 /dev/ttys005
14
Python  17990 simon    2u     CHR               16,5   0t94656                6931 /dev/ttys005
15
Python  17990 simon    3u  KQUEUE                                                  count=0, state=0xa
16
Python  17990 simon    4u    unix 0x67a396d5b54b61cb       0t0                     ->0x67a396d5b54b522b
17
Python  17990 simon    5u    unix 0x67a396d5b54b522b       0t0                     ->0x67a396d5b54b61cb
18
Python  17990 simon    6r     REG                1,5 747413504           187550734 /private/tmp/covid-smaller.db
19
Python  17990 simon    7u  KQUEUE                                                  count=0, state=0xa
20
Python  17990 simon    8u    unix 0x67a396d5b54b68d3       0t0                     ->0x67a396d5b54b5613
21
Python  17990 simon    9u    unix 0x67a396d5b54b5613       0t0                     ->0x67a396d5b54b68d3
22
Python  17990 simon   10u    IPv4 0x67a396d59c718b2b       0t0                 TCP localhost:8422 (LISTEN)
23
Python  17990 simon   12r     REG                1,5 747413504           187550734 /private/tmp/covid-smaller.db

The column with FD=cwd, TYPE=DIR shows the working directory for the process.

The TYPE=IPv4 one is interesting, it shows that we are listening on localhost:8422.

PID listening on a port#

To find out which process is listening on a specific port, use lsof -i :8000. For example:

1
~ % lsof -i :8000
2
COMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
3
Python  23862 simon    3u  IPv4 0x78af109648024857      0t0  TCP localhost:irdmi (LISTEN)