If you have ever tried to unmount a filesystem, USB stick, cdrom, etc… but found that it was busy and therefore could not be unmounted, you will like the fuser command. Fuser’s man page tells us that fuser will “Show which processes use the named files, sockets, or filesystems.” But you can do more than that! You can also use fuser to send signals to your processes telling them to shutdown, terminate, pause, etc…
Use Fuser to Find Which Processes are Using a Filesystem
One of the things that used to annoy me the most was when I would try to unmount a filesystem and I would find that a process was using it and I would get the “device is busy” message.
# umount /myfilesystem umount: /myfilesystem: device is busy. (In some cases useful info about processes that use the device is found by lsof(8) or fuser(1))
Now, when I get that message, I simply use fuser to find which processes are using files in that filesystem.
Example: Show linux processes using /myfilesystem
$ sudo fuser -mauv /myfilesystem [sudo] password for jstaten: USER PID ACCESS COMMAND /myfilesystem: root 20150 ..c.. (root)bash root 20688 ..c.. (root)bash root 30907 ..c.. (root)su mary 30908 ..c.. (mary)bash mary 30947 F.c.. (mary)vim
As we look at the output from the fuser command above, we see that both the root user and the mary user have processes in the filesystem. We can review the columns and get lots of information. The USER, PID, and COMMAND columns are similar to the columns from the ps command and are self-explanatory. The USER column tells us the user id for the process. The PID column tells us the process id of that process. The COMMAND column tells us the command the process is running as well as the userid again in parenthesis. The ACCESS column tells us how the process is using the file. The ACCESS column may include he following letters referencing these access types:
|ACCESS Column Code||Code’s Definition|
|F||file is open for writing.|
|f,o||The process has an open file.|
|r||The process’ root or home directory is on this filesystem (chroot).|
|c||The process’ current directory is on this filesystem.|
|e,t||The process is executing a file.|
|m,s||The process has a mapped file or is using a shared library.|
Using LSOF (List Open Files)
We can also use the “lsof” (list open files) command to show a similar report.
Example: Using lsof to find processes using a specified filesystem.
# lsof /myfilesystem COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 26984 mary cwd DIR 202,17 4096 2 /backup vim 28856 mary cwd DIR 202,17 4096 2 /backup vim 28856 mary cwd REG 202,17 12288 17 /backup/.bob.swn
Find and Killing Processes Using Fuser
For the more confident system administrators, fuser has a kill option (-k) that can be used to kill whatever processes are found using a file or filesystem.
Example: Find whatever processes are using the /myfilesystem and shut them down!
# fuser -mauvk /myfilesystem USER PID ACCESS COMMAND /backup: mary 11708 ..c.. (mary)bash mary 11734 F.c.. (mary)vim root 20150 ..c.. (root)bash root 20688 ..c.. (root)bash Killed (core dumped)
Interestingly, in the above example, we found that our very process was using the /myfilesystem filesystem. We ran the fuser command with the kill option (-k) telling it to kill the processes. As ours was amongst them, it killed our process.
Use Fuser to Find Which Processes / Daemons are Listening on a Port
Fuser has additional uses. Sometimes, we want to find out what process and userid are utilizing a port on our system. We can specify the IP version with -v4 for IPv4 or -v6 for IPv6.
Example: Find out what process is handling our http traffic on port 80
$ sudo fuser -v4 80/tcp USER PID ACCESS COMMAND 80/tcp: varnish 18984 F.... varnishd
We were able to find out that varnishd is handling our http traffic on port 80/tcp.
Kill Whatever Process is Listening on a Port
Let’s imagine that you need to shutdown whatever is running on port 8001/tcp for some reason. Perhaps, you have a process that normally runs on that port, but something else has taken it while you have been performing some maintenance. We can use fuser to find and kill the process in one command by using the fuser command with the -k option.
Example: Find and kill whatever process is listening on port 8001/tcp
$ sudo fuser -vk 8001/tcp USER PID ACCESS COMMAND 8001/tcp: root 19107 F.... httpd apache 21020 F.... httpd apache 21023 F.... httpd apache 21025 F.... httpd apache 25768 F.... httpd apache 25769 F.... httpd (Fuser found that the apache user was running the httpd process on port 8001/tcp and killed it. Now run fuser again to verify that 8001/tcp is clear) $ sudo fuser -v4 8001/tcp (Nothing is returned. Fuser successfully killed the process.)
Specifying the Signal Fuser Will Use as it Kills a Process
You can change the signal used when killing a process using fuser by simply listing it as an option to your fuser command. You can list the available signals using “fuser -l”.
# fuser -l HUP INT QUIT ILL TRAP ABRT IOT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH IO PWR SYS UNUSED
and then use withever signal you want it to use:
$ sudo fuser -mauvk -HUP /backup USER PID ACCESS COMMAND /myfilesystem: mary 27176 ..c.. (jstaten)bash mary 27260 F.c.. (jstaten)vim
Fuser is a powerful tool that can help you find which linux process is using your files or ports. Here are a few other resources that can give you additional information on fuser.