List all open files

[root@web ~]# lsof | more
COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 253,1 4096 2 /
systemd 1 root rtd DIR 253,1 4096 2 /
systemd 1 root txt REG 253,1 1482272 12491 /usr/lib/systemd/systemd
systemd 1 root mem REG 253,1 20040 5304 /usr/lib64/libuuid.so.1.3.0
systemd 1 root mem REG 253,1 256960 16014 /usr/lib64/libblkid.so.1.1.0
systemd 1 root mem REG 253,1 90664 5379 /usr/lib64/libz.so.1.2.7
systemd 1 root mem REG 253,1 157424 5266 /usr/lib64/liblzma.so.5.2.2
systemd 1 root mem REG 253,1 23968 5911 /usr/lib64/libcap-ng.so.0.0.0
systemd 1 root mem REG 253,1 19888 5705 /usr/lib64/libattr.so.1.1.0
systemd 1 root mem REG 253,1 19776 15352 /usr/lib64/libdl-2.17.so
systemd 1 root mem REG 253,1 398264 5305 /usr/lib64/libpcre.so.1.2.0
systemd 1 root mem REG 253,1 2118128 4967 /usr/lib64/libc-2.17.so
systemd 1 root mem REG 253,1 143944 4997 /usr/lib64/libpthread-2.17.so
systemd 1 root mem REG 253,1 88720 26127 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
systemd 1 root mem REG 253,1 44448 15376 /usr/lib64/librt-2.17.so
systemd 1 root mem REG 253,1 265024 10516 /usr/lib64/libmount.so.1.1.0
systemd 1 root mem REG 253,1 91792 26778 /usr/lib64/libkmod.so.2.2.10
systemd 1 root mem REG 253,1 122936 5394 /usr/lib64/libaudit.so.1.0.0
systemd 1 root mem REG 253,1 61672 9477 /usr/lib64/libpam.so.0.83.1
systemd 1 root mem REG 253,1 20024 5710 /usr/lib64/libcap.so.2.22
systemd 1 root mem REG 253,1 155744 5377 /usr/lib64/libselinux.so.1
systemd 1 root mem REG 253,1 159640 15344 /usr/lib64/ld-2.17.so
systemd 1 root 0u CHR 1,3 0t0 4788 /dev/null
systemd 1 root 1u CHR 1,3 0t0 4788 /dev/null
systemd 1 root 2u CHR 1,3 0t0 4788 /dev/null
systemd 1 root 3u a_inode 0,9 0 4784 [timerfd]
systemd 1 root 4u a_inode 0,9 0 4784 [eventpoll]
systemd 1 root 5u a_inode 0,9 0 4784 [signalfd]
systemd 1 root 6r DIR 0,20 0 6553 /sys/fs/cgroup/systemd
systemd 1 root 8u netlink 0t0 9539 KOBJECT_UEVENT
systemd 1 root 9r REG 0,3 0 6811 /proc/1/mountinfo

List process which opened a specific file

[root@web ~]# lsof /var/log/fail2ban.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
fail2ban- 1220 root 4w REG 253,1 214 4342 /var/log/fail2ban.log
[root@web ~]#

List open files under a directory

[root@web ~]# lsof +D /var/log/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
firewalld 468 root 3w REG 253,1 355 5744 /var/log/firewalld
tuned 989 root 3w REG 253,1 17395 21726 /var/log/tuned/tuned.log
gunicorn 990 webapp 4w REG 253,1 83302 5009 /var/log/gunicorn.log
rsyslogd 992 root 3w REG 253,1 8203 2608 /var/log/cron
rsyslogd 992 root 4w REG 253,1 36704 9488 /var/log/messages
rsyslogd 992 root 5w REG 253,1 1959836 8305 /var/log/maillog
rsyslogd 992 root 8w REG 253,1 1515 9501 /var/log/secure
php-fpm 1068 root 2w REG 253,1 6126788828 20697 /var/log/php-fpm.log
php-fpm 1068 root 4w REG 253,1 6126788828 20697 /var/log/php-fpm.log
fail2ban- 1220 root 4w REG 253,1 214 4342 /var/log/fail2ban.log
nginx 2536 root 2w REG 253,1 58860 137141 /var/log/nginx/error.log
nginx 2536 root 8w REG 253,1 58860 137141 /var/log/nginx/error.log
nginx 2538 nginx 2w REG 253,1 58860 137141 /var/log/nginx/error.log
nginx 2538 nginx 8w REG 253,1 58860 137141 /var/log/nginx/error.log
gunicorn 18219 webapp 4w REG 253,1 83302 5009 /var/log/gunicorn.log
gunicorn 28657 webapp 4w REG 253,1 83302 5009 /var/log/gunicorn.log
[root@web ~]#

List open files under a mount point

[root@web ~]# lsof /home/amar/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 22009 amar cwd DIR 253,1 4096 128013 /home/amar
sudo 22208 root cwd DIR 253,1 4096 128013 /home/amar
[root@web ~]#