Inspect One Process Open Files

You need a small sample of open files for a known PID.

Command

sudo lsof -p 1234 | head

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not share raw lsof output without redacting private paths and sockets.

A small sample of files, sockets, and descriptors owned by PID 1234.

Read-only, sensitive output. Nothing changes. The command reads current state and prints diagnostic evidence.

May require elevated permissions on protected paths or service-owned files.

Recovery / rollback: no state is changed.

Use only after replacing 1234 with the target PID.

Do not share raw lsof output without redacting private paths and sockets.

Example run

These are the commands shown for inspection. Treat them as an example, not proof that your system will behave identically.

next steps

Linux Survival Basics Sensitive output

Count handles for the target process before raising limits.

sudo lsof -p 1234 | wc -l

Linux Survival Basics Sensitive output

Find the process holding the dpkg lock before touching lock files.

sudo lsof /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock 2>/dev/null

Linux Survival Basics Can be slow

The server felt slow. Memory pressure was the first thing to rule out.

ps -eo pid,comm,%mem,%cpu --sort=-%mem | head

Linux Survival Basics Read-only

You can inspect an archive without extracting it.

tar -tf archives/site-backup.tar | sort | head

Linux Survival Basics Read-only

The hidden carriage return is often the whole bug.

head -1 script.sh | cat -v

next diagnostic step

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.