Find Which Linux Process is Using Your Files or Ports

Find Which Linux Process is Using Your Files or Ports

Find Which Linux Process is Using Your Files or Ports

If you have ever tried to unmount a filesystem, USB stick, cdrom, etc… but found that it was busy and therefore could not be unmounted, you will like the fuser command.  Fuser’s man page tells us that fuser will “Show which processes use the named files, sockets, or filesystems.”  But you can do more than that!  You can also use fuser to send signals to your processes telling them to shutdown, terminate, pause, etc…

Use Fuser to Find Which Processes are Using a Filesystem

One of the things that used to annoy me the most was when I would try to unmount a filesystem and I would find that a process was using it and I would get the “device is busy” message.

# umount /myfilesystem
umount: /myfilesystem: device is busy.
 (In some cases useful info about processes that use
 the device is found by lsof(8) or fuser(1))

Now, when I get that message, I simply use fuser to find which processes are using files in that filesystem.

Example:  Show linux processes using /myfilesystem

$ sudo fuser -mauv /myfilesystem
[sudo] password for jstaten:
                   USER      PID ACCESS COMMAND
/myfilesystem:     root    20150 ..c.. (root)bash
                   root    20688 ..c.. (root)bash
                   root    30907 ..c.. (root)su
                   mary    30908 ..c.. (mary)bash
                   mary    30947 F.c.. (mary)vim

As we look at the output from the fuser command above, we see that both the root user and the mary user have processes in the filesystem.  We can review the columns and get lots of information.  The USER, PID, and COMMAND columns are similar to the columns from the ps command and are self-explanatory.  The USER column tells us the user id for the process.  The PID column tells us the process id of that process.  The COMMAND column tells us the command the process is running as well as the userid again in parenthesis.  The ACCESS column tells us how the process is using the file.  The ACCESS column may include he following letters referencing these access types:

ACCESS Column Code Code’s Definition
F file is open for writing.
f,o The process has an open file.
r The process’ root or home directory is on this filesystem (chroot).
c The process’ current directory is on this filesystem.
e,t The process is executing a file.
m,s The process has a mapped file or is using a shared library.


Using LSOF (List Open Files)

We can also use the “lsof” (list open files) command to show a similar report.

Example:  Using lsof to find processes using a specified filesystem.

# lsof /myfilesystem
bash 26984  mary cwd DIR 202,17 4096 2 /backup
vim 28856   mary cwd DIR 202,17 4096 2 /backup
vim 28856   mary cwd REG 202,17 12288 17 /backup/.bob.swn


Find and Killing Processes Using Fuser

For the more confident system administrators, fuser has a kill option (-k) that can be used to kill whatever processes are found using a file or filesystem.

Example:  Find whatever processes are using the /myfilesystem and shut them down!

# fuser -mauvk /myfilesystem
                USER      PID ACCESS COMMAND
/backup:        mary    11708 ..c.. (mary)bash
                mary    11734 F.c.. (mary)vim
                root    20150 ..c.. (root)bash
                root    20688 ..c.. (root)bash
Killed (core dumped)

Interestingly, in the above example, we found that our very process was using the /myfilesystem filesystem.  We ran the fuser command with the kill option (-k) telling it to kill the processes.  As ours was amongst them, it killed our process.

Use Fuser to Find Which Processes / Daemons are Listening on a Port

Fuser has additional uses.  Sometimes, we want to find out what process and userid are utilizing a port on our system.  We can specify the IP version with -v4 for IPv4 or -v6 for IPv6.

Example:  Find out what process is handling our http traffic on port 80

$ sudo fuser -v4 80/tcp
80/tcp:   varnish 18984 F.... varnishd

We were able to find out that varnishd is handling our http traffic on port 80/tcp.

Kill Whatever Process is Listening on a Port

Let’s imagine that you need to shutdown whatever is running on port 8001/tcp for some reason.  Perhaps, you have a process that normally runs on that port, but something else has taken it while you have been performing some maintenance.  We can use fuser to find and kill the process in one command by using the fuser command with the -k option.

Example:  Find and kill whatever process is listening on port 8001/tcp

$ sudo fuser -vk 8001/tcp
8001/tcp: root   19107 F.... httpd
          apache 21020 F.... httpd
          apache 21023 F.... httpd
          apache 21025 F.... httpd
          apache 25768 F.... httpd
          apache 25769 F.... httpd

(Fuser found that the apache user was running the httpd process on port 8001/tcp and killed it.  Now run fuser again to verify that 8001/tcp is clear)

$ sudo fuser -v4 8001/tcp

(Nothing is returned.  Fuser successfully killed the process.)


Specifying the Signal Fuser Will Use as it Kills a Process

You can change the signal used when killing a process using fuser by simply listing it as an option to your fuser command.  You can list the available signals using “fuser -l”.

# fuser -l

and then use withever signal you want it to use:

$ sudo fuser -mauvk -HUP /backup
               USER   PID ACCESS COMMAND
/myfilesystem: mary 27176 ..c.. (jstaten)bash
               mary 27260 F.c.. (jstaten)vim


Other Resources

Fuser is a powerful tool that can help you find which linux process is using your files or ports.  Here are a few other resources that can give you additional information on fuser. 


The following two tabs change content below.
Jeff has 20 years of professional IT experience, having done nearly everything in his roles of IT consultant, Systems Integrator, Systems Engineer, CNOC Engineer, Systems Administrator, Network Systems Administrator, and IT Director. If there is one thing he knows for sure, it is that there is always a simple answer to every IT problem and that downtime begins with complexity. Seasoned IT professional by day, Jeff hopes to help other IT professionals by blogging about his experiences at night on his blog: You can find Jeff on or LinkedIn at: LinkedIn or Twitter at: Twitter

Latest posts by Jeff Staten (see all)

Leave a Reply

Your email address will not be published. Required fields are marked *