I was going through the questions of this site. In this particular question, I see the command lsof being used to list the files that are open for a particular user. I ran the below command in my terminal.

lsof -a -u root -d txt

I am seeing a long output which are completely irrelevant (at least to me). I am finding it hard to understand the output produced. This is

mapping-d  3992 root txt       REG    8,5    29728 7169187 /usr/libexec/mapping-daemon
clock-app  4005 root txt       REG    8,5    88048 7169216 /usr/libexec/clock-applet
mixer_app  4007 root txt       REG    8,5    53484 7169197 /usr/libexec/mixer_applet2
gnome-scr  4078 root txt       REG    8,5   168628 1337742 /usr/bin/gnome-screensaver
notificat  4081 root txt       REG    8,5    34732 1324168 /usr/libexec/notification-daemon
gnome-ter  4219 root txt       REG    8,5   309400 1318348 /usr/bin/gnome-terminal
gnome-pty  4221 root txt       REG    8,5    12384 1899888 /usr/lib/vte/gnome-pty-helper
bash       4222 root txt       REG    8,5   735932  196459 /bin/bash
firefox   15551 root txt       REG    8,5   121288 2424613 /usr/lib/firefox/firefox
npviewer. 15790 root txt       REG    8,5   174364 1996912 /usr/lib/nspluginwrapper/npviewer.bin
bash      15908 root txt       REG    8,5   735932  196459 /bin/bash
lsof      16014 root txt       REG    8,5   129820 1323233 /usr/sbin/lsof
lsof      16015 root txt       REG    8,5   129820 1323233 /usr/sbin/lsof

I was expecting, if I had opened a txt file as the root user, only that file's information would be displayed, if I run the lsof command. Can someone please help me in understanding what this command actually produces as the output?


lsof lists all files that are accessed by a program one way or another. The fourth column (FD) describes the way in which the program is accessing the file. Here are some common cases (there are others):

  • A number: the file is opened by the process, and the number is the file descriptor. Letters after the file name indicate the opening mode (e.g. r for read-only, w for write-only, u for both).
  • cwd: the file is the process's current working directory.
  • txt: the file is the process's executable.
  • mem: the file is mapped to the process's virtual memory space.

The descriptor type txt has nothing to do with “text files” in the sense of containing human-readable text or of having a name ending with .txt. Here “text” is an odd bit of terminology refering to executable code, as in the text segment of an executable file which is the section that contain the code. This strange name comes from a now-defunct programming community which predates Unix (General Electric, whose other naming legacy in the Unix world is the “GECOS field”).

Thus what you're seeing is the main executable of each process.


The output is organized into columns. If you want to store this output in a file so that you can review it later simply do this:

$ lsof -a -u root -d txt > somefile.txt

The columns are right along the top.


Description of columns

The columns are as follows:

mapping-d  3992 root txt       REG    8,5    29728 7169187 /usr/libexec/mapping-daemon
clock-app  4005 root txt       REG    8,5    88048 7169216 /usr/libexec/clock-applet
mixer_app  4007 root txt       REG    8,5    53484 7169197 /usr/libexec/mixer_applet2
  • COMMAND - this is the name of the executable that is using a file.

  • PID - Process ID, this is the process ID of the executable. You'd see these in the output of the ps command as well.

  • USER - This is the userid that the process is owned by.

  • FD - File Descriptor. You specified that you only wanted text file descriptors (-d txt) so you should only see txt in this column. From the man page of lsof, " txt program text (code and data);"

  • TYPE - This denotes the type of node associated with the file. Again consult the man page of lsof. There are a lot of different types of nodes. Here we're primarily dealing with regular files, so you'll see the keyword REG.

  • DEVICE - This column contains device numbers. These are the corresponding devices that are being used for the particular file, from the systems /dev directory.

  • SIZE/OFF - size of the file or the file offset in bytes.

  • NODE - Consult the man page of lsof, in general it's either the node number of a local file, or inode number of an NFS file in the server host, but can be other values as well.

  • NAME - name of file or name of the mount point and file system on which the file resides.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.