Is there a way to make lsof work continuously to monitor every file that is being opened in real time?

I don't know the name of the process. I want lsof to work continuously for a period of time until I see the the list contains what I want.


I believe since you do not know the file name/process id, you could specify user name option as below.

lsof -r 2 -u username
  • The "-r 2" option puts lsof in repeat mode, with updates every 2 seconds. (Ctrl -c quits)
  • The "-u' option can be used to keep an eye on a users activity.

If you know the directory name under which the application is being run and do not want to specify the user name,you could use the command like,

lsof +D /some/dir -r 2 


View Network Activity of any application or user in real time

  • @DigitalRobot, you could also refer to this link for more wonderful examples. – Ramesh Sep 23 '14 at 15:11
  • fantastic!!!!!!!!!!!!!! – SpaceDog Sep 23 '14 at 15:18
  • 1
    there is a way to see what has changed in that period ? I mean sometimes the list is very large and I might just want to make something and see which files has been opened in that time. – yucer Dec 7 '15 at 10:38
  • 1
    Could a process open and close a file within the 2 second interval? – CMCDragonkai Dec 15 '15 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.