The fuser command in Linux is a command line utility used to identify the processes that are currently using a file, directory, socket, or file systems. The term "fuser" is an abbreviation for "file user".
It provides detailed information about the processes, including the user owning the process, the process ID, the type of access, and the command being used.
The fuser command is used to determining which processes are accessing a particular resource, which can be helpful in various scenarios such as:
- Identifying processes using a file: You can use
fuserto find out which processes are currently using a specific file or directory. This can be helpful when you need to unmount a file system or delete a file that is in use. - Identifying processes using a network socket:
fusercan also be used to identify the processes that are using a network socket, which can be useful for troubleshooting network-related issues. - Killing processes using a file or socket: Once you have identified the processes using a file or socket, you can use the
-koption to kill those processes.
It's particularly useful for troubleshooting issues related to file locking, process management, and system resources.
Table of Contents
fuser Command Syntax
The basic syntax of the fuser command is:
fuser [options] file|directory|socket
Options
Some common options used with fuser include:
-vor--verbose: Provides detailed output, including the user, process ID, access type, and command.-aor--all: Display all files specified on the command line.-kor--kill: Kills the processes accessing the specified file or socket.-ior--interactive: Asks for confirmation before killing a process.-lor--list-signals: Lists all available signal names.-mor--mount: Shows all processes accessing a file system or block device.-nor--namespace: Searches in a specific namespace (file, UDP, or TCP).-uor--user: Append the user name of the process owner to each PID.-c: Display the command name for each process.-4or--ipv4: Search only for IPv4 sockets.-6or--ipv6: Search only for IPv6 sockets.
Linux fuser Command Examples
1. List Processes Accessing a File
To find processes accessing a specific file, use:
fuser -v /path/to/file
For example, to find the processes using the /usr/bin/firefox-esr file, you can use the following command:
fuser --verbose /usr/bin/firefox-esr
This will display the process IDs (PIDs) of the processes that are currently using the /usr/bin/firefox-esr file.
Sample Output:
USER PID ACCESS COMMAND
/usr/lib/firefox-esr/firefox-esr:
ostechnix 6900 ...e. firefox-esr
ostechnix 6966 ...e. Socket Process
ostechnix 6984 ...e. Privileged Cont
ostechnix 7042 ...e. WebExtensions
ostechnix 7101 ...e. Isolated Web Co
ostechnix 7735 ...e. Isolated Web Co
ostechnix 8250 ...e. Isolated Web Co
ostechnix 8300 ...e. Isolated Web Co
ostechnix 8961 ...e. Isolated Web Co
ostechnix 41601 ...e. Isolated Web Co
ostechnix 41791 ...e. Isolated Web Co
ostechnix 45880 ...e. Isolated Web Co
ostechnix 46217 ...e. Isolated Web Co
ostechnix 46287 ...e. Isolated Web Co
ostechnix 46437 ...e. Isolated Web Co
ostechnix 47038 ...e. Isolated Web Co
ostechnix 47042 ...e. Isolated Web Co
ostechnix 47095 ...e. Isolated Web Co
ostechnix 47160 ...e. Isolated Web Co
ostechnix 47231 ...e. Isolated Web Co
ostechnix 47234 ...e. Isolated Web Co
ostechnix 47577 ...e. Isolated Web Co
ostechnix 47762 ...e. Isolated Web Co
ostechnix 47969 ...e. Isolated Web Co
ostechnix 48537 ...e. RDD Process
ostechnix 48539 ...e. Utility Process
ostechnix 49786 ...e. Web Content
ostechnix 52459 ...e. Web Content
ostechnix 52521 ...e. Web ContentHere's what each column in the output means:
USER: This column displays the username of the user running the process.PID: This column shows the Process ID (PID) of the process.ACCESS: This column indicates the type of access the process has to the file. The letters in this column represent the following:c: The process is using the file or directory as its current working directory.e: The process has executed the file (typically an executable binary).f: The process has opened the file for reading (this is omitted in the default display mode).F: The process has opened the file for writing (this is omitted in the default display mode).r: The process is using the directory as its root directory.m: The process has mapped the file or shared library into memory using mmap..: This is a placeholder and is omitted in the default display mode.
COMMAND: This column displays the name of the command or process that is accessing the file.
In the output above, you can see that there are multiple processes associated with the /usr/bin/firefox-esr file.
These processes are part of the Firefox ESR browser and handle different tasks, such as the main browser process, socket process, content processes, and various other helper processes.
For example, the process with PID 6900 is the main Firefox ESR browser process, and it has the file open for execution (...e.). The processes with PIDs 49786, 52459, and 52521 are likely Web Content processes used to render web pages in separate processes for better security and stability.
2. Find Processes Accessing a Directory
To find the processes accessing the current directory, you can use the following command:
fuser -v .
This will display the process IDs, users, access types, and commands for all processes accessing the current directory. For example:
USER PID ACCESS COMMAND
/home/ostechnix: ostechnix 1729 ..c.. pipewire
ostechnix 1733 ..c.. dbus-daemon
ostechnix 1734 ..c.. pipewire-media-
ostechnix 1740 ..c.. cinnamon-sessio
ostechnix 1785 ..c.. gvfsd
ostechnix 1797 ..c.. at-spi-bus-laun
ostechnix 1803 ..c.. dbus-daemon
ostechnix 1807 ..c.. at-spi2-registr
ostechnix 1818 ..c.. csd-background
ostechnix 1819 ..c.. csd-xrandr
[...]In this case, the processes with IDs 1729, 1733, 1734 among many other are accessing the /home/ostechnix directory using the various commands.
3. Find Processes accessing a File System
To find processes accessing a file system, use:
fuser -v -m /path/to/mountpoint
For example, to check which processes are accessing the filesystem mounted at /boot/efi/, you would run:
fuser -v -m /boot/efi/
Sample Output:
USER PID ACCESS COMMAND /boot/efi: root kernel mount /boot/efi
Here's the breakdown of the above output:
USER: This column shows the username of the process accessing the filesystem. In this case, it'sroot.PID: This column displays the Process ID (PID) of the process. However, instead of a numerical PID, it showskernelbecause the kernel itself is managing the filesystem mount.ACCESS: This column indicates the type of access the process has to the resource. In this case, it showsmount, which means the kernel has mounted the filesystem containing/boot/efi.COMMAND: This column displays the command or process name. It shows/boot/efi, which is the path that was specified in thefusercommand.
4. Kill Processes using a File or Socket
To kill processes accessing a file or socket, use:
sudo fuser -k /path/to/file (or) socket
For example, the following command will kill any processes that use the port 8006:
fuser -k 8006/tcp
Remember to exercise caution when using the -k option, as it can terminate processes abruptly. Always verify the impact before killing any processes.
There are also other ways to kill a process running on a port. Check our detailed guide for more details.
5. View Processes using a Port
To find processes using a specific TCP port (e.g., port 8006), use:
sudo fuser -v -n tcp 8006
Here,
- The
-vor--verboseoption displays more detailed information about the processes. - The
-nor--namespaceoption specifies the namespace to search for resources. In this case,tcpis used to search for processes using TCP sockets or ports. 8006: This is the specific TCP port number that the command is checking for processes using.
This command will show the processes associated with the 8006 port.
USER PID ACCESS COMMAND
8006/tcp: www-data 1691 F.... pveproxy
www-data 1692 F.... pveproxy worker
www-data 1693 F.... pveproxy worker
www-data 1694 F.... pveproxy workerLet us breakdown the above output and see what each option does.
USER: This column shows the username of the user running the process. In this case, it'swww-data, which is a common user for web server processes.PID: This column displays the Process ID (PID) of the process using the TCP port.ACCESS: This column shows the type of access the process has to the resource (in this case, the TCP port). The lettersF....indicate that the process has the TCP port open for writing (Fstands for "file" or socket).COMMAND: This column displays the name of the process or command using the TCP port.
Based on the output, there are four processes using the TCP port 8006:
- The process with PID 1691 is named
pveproxy. - The processes with PIDs 1692, 1693, and 1694 are named
pveproxy worker.
For those wondering, these processes are related to Proxmox VE (Virtual Environment), which is an open-source server virtualization management platform.
The pveproxy process is the main proxy process, and the pveproxy worker processes are worker processes that handle incoming connections on the specified TCP port (8006).
6. List Signals
We can use fuser to send specific signals to a process. To list all signals, run:
fuser -l
When you run fuser -l, you will see a complete list of the signals your system supports. This can be helpful when you need to understand the different types of signals available for managing processes.
HUP INT QUIT ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH POLL PWR SYS
Each of these signals has a specific meaning and use case. Here are some common signals:
- HUP (1): Hangup detected on controlling terminal or death of controlling process.
- INT (2): Interrupt from keyboard (like Ctrl+C).
- QUIT (3): Quit from keyboard.
- ILL (4): Illegal Instruction.
- ABRT (6): Abort signal from abort(3).
- KILL (9): Kill signal (cannot be caught or ignored).
- SEGV (11): Invalid memory reference.
- TERM (15): Termination signal.
- STOP (17, 19, 23): Stop the process (cannot be caught or ignored).
- CONT (18, 25): Continue if stopped.
- USR1 (10, 30, 16): User-defined signal 1.
- USR2 (12, 31, 17): User-defined signal 2.
These signals can be used in conjunction with other commands (such as kill) to control processes. For instance, you might use kill -9 PID to send a KILL signal to a process with a specific Process ID (PID).
7. Send a Signal to Processes
To send a specific signal to a process, use:
sudo fuser -k -SIGNAL /path/to/file
For instance, to send the SIGHUP signal to processes accessing a file or directory, you would run:
sudo fuser -k -HUP /path/to/file_or_directory
8. Getting Help
To view the help manual of fuser command, run:
man fuser
A Practical Example to Illustrate the Use of fuser Command in Linux
Suppose you want to unmount a filesystem, but you get an error message saying that the filesystem is busy. You can use the fuser command to find out which processes are using the filesystem and then send a signal to those processes to release the filesystem.
First, use the fuser command with the -m option to find out which processes are using the mount point. For example, to find out which processes are using the /mnt/data filesystem, you can run the following command:
sudo fuser -v -m /mnt/data
This will display a list of process IDs (PIDs) that are using the filesystem.
Next, you can use the kill command to send a signal to those processes to release the filesystem. For example, to send the SIGTERM signal to those processes, you can run the following command:
fuser -km /mnt/data
This will send the SIGTERM signal to all processes that are using the filesystem, giving them a chance to clean up and exit gracefully.
If the processes do not exit after a few seconds, you can use the SIGKILL signal instead to forcefully terminate the processes:
fuser -ki /mnt/data
Note that the -k option is used to send the signal to the processes, and the -i option is used to prompt for confirmation before sending the signal. You can omit the -i option if you want to send the signal immediately.
Conclusion
The fuser command is one of the useful tool for managing processes in Linux. It provides detailed information about the processes accessing files, directories, or sockets and allows you to kill or send signals to these processes as needed.
Especially, the fuser command is a valuable tool for system administrators and users who need to understand which processes are accessing specific resources on their Linux system.
