lsof is a command line utility which is used to list the information about the files that are opened by various processes. In unix, everything is a file, ( pipes, sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files
Simply typing lsof will provide a list of all open files belonging to all active processes
[callisto] (~) >>> lsof|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 202,2 4096 2 /
init 1 root rtd DIR 202,2 4096 2 /
init 1 root txt REG 202,2 150352 966707 /sbin/init (deleted)
init 1 root mem REG 202,2 65928 647197 /lib64/libnss_files-2.12.so
init 1 root mem REG 202,2 1926800 647181 /lib64/libc-2.12.so
init 1 root mem REG 202,2 93320 647243 /lib64/libgcc_s-4.4.7-20120601.so.1
init 1 root mem REG 202,2 47064 647209 /lib64/librt-2.12.so
init 1 root mem REG 202,2 145896 647207 /lib64/libpthread-2.12.so
init 1 root mem REG 202,2 268232 647294 /lib64/libdbus-1.so.3.4.0
One open file is displayed per line and, unless you specify otherwise, all open files from all processes are displayed. The Command, PID, and User columns represent the name of a process, process identifier (PID), and owner's name, respectively. The Device, SIZE/OFF, Node, and Name columns refer to the file itself, specifying the name of the disk, size of the file, inode (the file's identification on the disk), and actual name of the file. Depending on the flavor of UNIX, the size of the file might also be reported as the current position the application is reading in the file (offset).
Find all the processes for a specific user using lsof -u USER
[callisto] (~) >>> lsof -u ryan|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
screen 16567 ryan cwd DIR 202,2 4096 3065532 /home/ryan
screen 16567 ryan rtd DIR 202,2 4096 2 /
screen 16567 ryan txt REG 202,2 389192 52604 /usr/bin/screen
screen 16567 ryan mem REG 202,2 156928 647173 /lib64/ld-2.12.so
screen 16567 ryan mem REG 202,2 9264 51095 /usr/lib64/libutempter.so.1.1.5
screen 16567 ryan mem REG 202,2 1926800 647181 /lib64/libc-2.12.so
screen 16567 ryan mem REG 202,2 22536 647185 /lib64/libdl-2.12.so
screen 16567 ryan mem REG 202,2 138280 647567 /lib64/libtinfo.so.5.7
screen 16567 ryan mem REG 202,2 472064 647187 /lib64/libfreebl3.so
To see all the processes writing to a specific file:
[callisto] (~) >>> lsof /var/log/messages
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 1097 root 1w REG 202,2 330446 3786258 /var/log/messages
abrt-dump 1549 root 4r REG 202,2 330446 3786258 /var/log/messages
If you just want to grab the PIDs for a binary or log file you can use the -t option:
[callisto] (~) >>> lsof -t /usr/sbin/sshd
1343
18424
18428
25299
25305
With the PID you can narrow your search even further to see what the process is actually doing using the -p option:
[callisto] (~) >>> lsof -p 25305|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 25305 ryan cwd DIR 202,2 4096 2 /
sshd 25305 ryan rtd DIR 202,2 4096 2 /
sshd 25305 ryan txt REG 202,2 546680 51491 /usr/sbin/sshd
sshd 25305 ryan DEL REG 0,4 5012920 /dev/zero
sshd 25305 ryan mem REG 202,2 6096 647446 /lib64/security/pam_shells.so
sshd 25305 ryan mem REG 202,2 18592 647428 /lib64/security/pam_limits.so
sshd 25305 ryan mem REG 202,2 10224 647426 /lib64/security/pam_keyinit.so
sshd 25305 ryan mem REG 202,2 10240 647431 /lib64/security/pam_loginuid.so
sshd 25305 ryan mem REG 202,2 18664 647443 /lib64/security/pam_selinux.so
[saturn] (~) >>> lsof /srv|tail
dropbox 873 deluge mem REG 8,49 13744 271807 /srv/deluge/.dropbox-dist/fcntl.so
dropbox 873 deluge mem REG 8,49 17336 271937 /srv/deluge/.dropbox-dist/cStringIO.so
dropbox 873 deluge mem REG 8,49 16740 271890 /srv/deluge/.dropbox-dist/binascii.so
dropbox 873 deluge mem REG 8,49 10596 271885 /srv/deluge/.dropbox-dist/_random.so
dropbox 873 deluge mem REG 8,49 28936 271950 /srv/deluge/.dropbox-dist/math.so
dropbox 873 deluge mem REG 8,49 9116 271886 /srv/deluge/.dropbox-dist/_functools.so
dropbox 873 deluge mem REG 8,49 19572 271875 /srv/deluge/.dropbox-dist/zlib.so
dropbox 873 deluge 5u REG 8,49 12288 262155 /srv/deluge/.dropbox/config.dbx
smbd 17862 root cwd DIR 8,49 4096 262146 /srv/deluge/completed
smbd 17862 root 8r DIR 8,49 4096 262146 /srv/deluge/completed
[callisto] (~) >>> lsof -i|grep sshd
sshd 1343 root 3u IPv4 9453 0t0 TCP *:65195 (LISTEN)
sshd 1343 root 4u IPv6 9455 0t0 TCP *:65195 (LISTEN)
sshd 18424 root 3r IPv4 4992325 0t0 TCP callisto.example.com:65195->isd01.domain.com:37081 (ESTABLISHED)
sshd 18428 ryan 3u IPv4 4992325 0t0 TCP callisto.example.com:65195->isd01.domain.com:37081 (ESTABLISHED)
sshd 25299 root 3r IPv4 5012872 0t0 TCP callisto.example.com:65195->hyperion.example.com:34272 (ESTABLISHED)
sshd 25305 ryan 3u IPv4 5012872 0t0 TCP callisto.example.com:65195->hyperion.example.com:34272 (ESTABLISHED)
[callisto] (~) >>> lsof [email protected]
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 18424 root 3r IPv4 4992325 0t0 TCP callisto.example.com:65195->x.x.x.x:37081 (ESTABLISHED)
sshd 18428 ryan 3u IPv4 4992325 0t0 TCP callisto.example:65195->x.x.x.x:37081 (ESTABLISHED)
[callisto] (~) >>> lsof -iUDP|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
controlle 1883 root 6u IPv4 13924 0t0 UDP *:nimcontroller
named 4801 named 512u IPv6 445845 0t0 UDP *:domain
named 4801 named 513u IPv4 445850 0t0 UDP localhost.localdomain:domain
named 4801 named 514u IPv4 445852 0t0 UDP 10.8.x.x:domain
named 4801 named 515u IPv4 445854 0t0 UDP callisto.example.com:domain
named 4801 named 516u IPv4 445856 0t0 UDP 184.x.x.10-static.reverse.example.com:domain
named 4801 named 517u IPv4 445858 0t0 UDP 184.x.x.11-static.reverse.example.com:domain
named 4801 named 518u IPv4 445860 0t0 UDP 184.x.x.11-static.reverse.example.com:domain
named 4801 named 519u IPv4 445862 0t0 UDP 184.x.x.11-static.reverse.example.com:domain
[callisto] (~) >>> lsof -iTCP|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1343 root 3u IPv4 9453 0t0 TCP *:65195 (LISTEN)
sshd 1343 root 4u IPv6 9455 0t0 TCP *:65195 (LISTEN)
cpsrvd-ss 1730 root 3u IPv4 13106 0t0 TCP *:infowave (LISTEN)
cpsrvd-ss 1730 root 4u IPv4 13107 0t0 TCP *:nbx-ser (LISTEN)
cpsrvd-ss 1730 root 5u IPv4 13108 0t0 TCP *:radsec (LISTEN)
cpsrvd-ss 1730 root 6u IPv4 13109 0t0 TCP *:nbx-dir (LISTEN)
cpsrvd-ss 1730 root 9u IPv4 13114 0t0 TCP *:gnunet (LISTEN)
cpsrvd-ss 1730 root 10u IPv4 13115 0t0 TCP *:eli (LISTEN)
controlle 1883 root 5u IPv4 13921 0t0 TCP *:nimcontroller (LISTEN)
Find ports that are awaiting connections. You can also do this by grepping for LISTEN
[callisto] (~) >>> lsof -i -sTCP:LISTEN|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1343 root 3u IPv4 9453 0t0 TCP *:65195 (LISTEN)
sshd 1343 root 4u IPv6 9455 0t0 TCP *:65195 (LISTEN)
cpsrvd-ss 1730 root 3u IPv4 13106 0t0 TCP *:infowave (LISTEN)
cpsrvd-ss 1730 root 4u IPv4 13107 0t0 TCP *:nbx-ser (LISTEN)
cpsrvd-ss 1730 root 5u IPv4 13108 0t0 TCP *:radsec (LISTEN)
cpsrvd-ss 1730 root 6u IPv4 13109 0t0 TCP *:nbx-dir (LISTEN)
cpsrvd-ss 1730 root 9u IPv4 13114 0t0 TCP *:gnunet (LISTEN)
cpsrvd-ss 1730 root 10u IPv4 13115 0t0 TCP *:eli (LISTEN)
controlle 1883 root 5u IPv4 13921 0t0 TCP *:nimcontroller (LISTEN)
[callisto] (~) >>> lsof -i | grep -i LISTEN|head
sshd 1343 root 3u IPv4 9453 0t0 TCP *:65195 (LISTEN)
sshd 1343 root 4u IPv6 9455 0t0 TCP *:65195 (LISTEN)
cpsrvd-ss 1730 root 3u IPv4 13106 0t0 TCP *:infowave (LISTEN)
cpsrvd-ss 1730 root 4u IPv4 13107 0t0 TCP *:nbx-ser (LISTEN)
cpsrvd-ss 1730 root 5u IPv4 13108 0t0 TCP *:radsec (LISTEN)
cpsrvd-ss 1730 root 6u IPv4 13109 0t0 TCP *:nbx-dir (LISTEN)
cpsrvd-ss 1730 root 9u IPv4 13114 0t0 TCP *:gnunet (LISTEN)
cpsrvd-ss 1730 root 10u IPv4 13115 0t0 TCP *:eli (LISTEN)
controlle 1883 root 5u IPv4 13921 0t0 TCP *:nimcontroller (LISTEN)
spooler 1924 root 8u IPv4 14035 0t0 TCP *:nimspooler (LISTEN)