lsof — “list open files” — was written by Vic Abell in the early 1990s and does exactly what it says, which turns out to be an enormous amount. Since everything on Unix is a file, lsof reveals open regular files, sockets, pipes, devices, and network connections for every process on the system. It is the tool you reach for when a filesystem won’t unmount (“something is using it”), when you need to know which process is holding a port, or when you simply want to know what your applications are actually doing behind your back. The output on a busy server is several thousand lines of quietly unsettling activity. lsof has no particularly dramatic origin story; it is simply one of those tools that, once discovered, immediately becomes impossible to do without.
