Home Linux Commands Fuser Command In Linux: A Beginners Guide With Examples

Fuser Command In Linux: A Beginners Guide With Examples

Linux fuser Command Tutorial: Learn to Identify Processes using Files and Sockets.

By sk
326 views

The fuser command in Linux is a command line utility used to identify the processes that are currently using a file, directory, socket, or file systems. The term "fuser" is an abbreviation for "file user".

It provides detailed information about the processes, including the user owning the process, the process ID, the type of access, and the command being used.

The fuser command is used to determining which processes are accessing a particular resource, which can be helpful in various scenarios such as:

  1. Identifying processes using a file: You can use fuser to find out which processes are currently using a specific file or directory. This can be helpful when you need to unmount a file system or delete a file that is in use.
  2. Identifying processes using a network socket: fuser can also be used to identify the processes that are using a network socket, which can be useful for troubleshooting network-related issues.
  3. Killing processes using a file or socket: Once you have identified the processes using a file or socket, you can use the -k option to kill those processes.

It's particularly useful for troubleshooting issues related to file locking, process management, and system resources.

fuser Command Syntax

The basic syntax of the fuser command is:

fuser [options] file|directory|socket

Options

Some common options used with fuser include:

  • -v or --verbose: Provides detailed output, including the user, process ID, access type, and command.
  • -a or --all: Display all files specified on the command line.
  • -k or --kill: Kills the processes accessing the specified file or socket.
  • -i or --interactive: Asks for confirmation before killing a process.
  • -l or --list-signals: Lists all available signal names.
  • -m or --mount: Shows all processes accessing a file system or block device.
  • -n or --namespace: Searches in a specific namespace (file, UDP, or TCP).
  • -u or --user: Append the user name of the process owner to each PID.
  • -c: Display the command name for each process.
  • -4 or --ipv4: Search only for IPv4 sockets.
  • -6 or --ipv6: Search only for IPv6 sockets.

Linux fuser Command Examples

1. List Processes Accessing a File

To find processes accessing a specific file, use:

fuser -v /path/to/file

For example, to find the processes using the /usr/bin/firefox-esr file, you can use the following command:

fuser --verbose /usr/bin/firefox-esr

This will display the process IDs (PIDs) of the processes that are currently using the /usr/bin/firefox-esr file.

Sample Output:

                     USER        PID ACCESS COMMAND
/usr/lib/firefox-esr/firefox-esr:
                     ostechnix   6900 ...e. firefox-esr
                     ostechnix   6966 ...e. Socket Process
                     ostechnix   6984 ...e. Privileged Cont
                     ostechnix   7042 ...e. WebExtensions
                     ostechnix   7101 ...e. Isolated Web Co
                     ostechnix   7735 ...e. Isolated Web Co
                     ostechnix   8250 ...e. Isolated Web Co
                     ostechnix   8300 ...e. Isolated Web Co
                     ostechnix   8961 ...e. Isolated Web Co
                     ostechnix  41601 ...e. Isolated Web Co
                     ostechnix  41791 ...e. Isolated Web Co
                     ostechnix  45880 ...e. Isolated Web Co
                     ostechnix  46217 ...e. Isolated Web Co
                     ostechnix  46287 ...e. Isolated Web Co
                     ostechnix  46437 ...e. Isolated Web Co
                     ostechnix  47038 ...e. Isolated Web Co
                     ostechnix  47042 ...e. Isolated Web Co
                     ostechnix  47095 ...e. Isolated Web Co
                     ostechnix  47160 ...e. Isolated Web Co
                     ostechnix  47231 ...e. Isolated Web Co
                     ostechnix  47234 ...e. Isolated Web Co
                     ostechnix  47577 ...e. Isolated Web Co
                     ostechnix  47762 ...e. Isolated Web Co
                     ostechnix  47969 ...e. Isolated Web Co
                     ostechnix  48537 ...e. RDD Process
                     ostechnix  48539 ...e. Utility Process
                     ostechnix  49786 ...e. Web Content
                     ostechnix  52459 ...e. Web Content
                     ostechnix  52521 ...e. Web Content

Here's what each column in the output means:

  • USER: This column displays the username of the user running the process.
  • PID: This column shows the Process ID (PID) of the process.
  • ACCESS: This column indicates the type of access the process has to the file. The letters in this column represent the following:
    • c: The process is using the file or directory as its current working directory.
    • e: The process has executed the file (typically an executable binary).
    • f: The process has opened the file for reading (this is omitted in the default display mode).
    • F: The process has opened the file for writing (this is omitted in the default display mode).
    • r: The process is using the directory as its root directory.
    • m: The process has mapped the file or shared library into memory using mmap.
    • .: This is a placeholder and is omitted in the default display mode.
  • COMMAND: This column displays the name of the command or process that is accessing the file.

      In the output above, you can see that there are multiple processes associated with the /usr/bin/firefox-esr file.

      These processes are part of the Firefox ESR browser and handle different tasks, such as the main browser process, socket process, content processes, and various other helper processes.

      For example, the process with PID 6900 is the main Firefox ESR browser process, and it has the file open for execution (...e.). The processes with PIDs 49786, 52459, and 52521 are likely Web Content processes used to render web pages in separate processes for better security and stability.

      2. Find Processes Accessing a Directory

      To find the processes accessing the current directory, you can use the following command:

      fuser -v .

      This will display the process IDs, users, access types, and commands for all processes accessing the current directory. For example:

                           USER        PID ACCESS COMMAND
      /home/ostechnix:     ostechnix   1729 ..c.. pipewire
                           ostechnix   1733 ..c.. dbus-daemon
                           ostechnix   1734 ..c.. pipewire-media-
                           ostechnix   1740 ..c.. cinnamon-sessio
                           ostechnix   1785 ..c.. gvfsd
                           ostechnix   1797 ..c.. at-spi-bus-laun
                           ostechnix   1803 ..c.. dbus-daemon
                           ostechnix   1807 ..c.. at-spi2-registr
                           ostechnix   1818 ..c.. csd-background
                           ostechnix   1819 ..c.. csd-xrandr
      [...]

      In this case, the processes with IDs 1729, 1733, 1734 among many other are accessing the /home/ostechnix directory using the various commands.

      3. Find Processes accessing a File System

      To find processes accessing a file system, use:

      fuser -v -m /path/to/mountpoint

      For example, to check which processes are accessing the filesystem mounted at /boot/efi/, you would run:

      fuser -v -m /boot/efi/

      Sample Output:

                           USER        PID ACCESS COMMAND
      /boot/efi:           root     kernel mount /boot/efi

      Here's the breakdown of the above output:

      • USER: This column shows the username of the process accessing the filesystem. In this case, it's root.
      • PID: This column displays the Process ID (PID) of the process. However, instead of a numerical PID, it shows kernel because the kernel itself is managing the filesystem mount.
      • ACCESS: This column indicates the type of access the process has to the resource. In this case, it shows mount, which means the kernel has mounted the filesystem containing /boot/efi.
      • COMMAND: This column displays the command or process name. It shows /boot/efi, which is the path that was specified in the fuser command.

      4. Kill Processes using a File or Socket

      To kill processes accessing a file or socket, use:

      sudo fuser -k /path/to/file (or) socket

      For example, the following command will kill any processes that use the port 8006:

      fuser -k 8006/tcp

      Remember to exercise caution when using the -k option, as it can terminate processes abruptly. Always verify the impact before killing any processes.

      There are also other ways to kill a process running on a port. Check our detailed guide for more details.

      5. View Processes using a Port

      To find processes using a specific TCP port (e.g., port 8006), use:

      sudo fuser -v -n tcp 8006

      Here,

      • The -v or --verbose option displays more detailed information about the processes.
      • The -n or --namespace option specifies the namespace to search for resources. In this case, tcp is used to search for processes using TCP sockets or ports.
      • 8006: This is the specific TCP port number that the command is checking for processes using.

      This command will show the processes associated with the 8006 port.

                           USER        PID ACCESS COMMAND
      8006/tcp:            www-data   1691 F.... pveproxy
                           www-data   1692 F.... pveproxy worker
                           www-data   1693 F.... pveproxy worker
                           www-data   1694 F.... pveproxy worker

      Let us breakdown the above output and see what each option does.

      • USER: This column shows the username of the user running the process. In this case, it's www-data, which is a common user for web server processes.
      • PID: This column displays the Process ID (PID) of the process using the TCP port.
      • ACCESS: This column shows the type of access the process has to the resource (in this case, the TCP port). The letters F.... indicate that the process has the TCP port open for writing (F stands for "file" or socket).
      • COMMAND: This column displays the name of the process or command using the TCP port.

      Based on the output, there are four processes using the TCP port 8006:

      1. The process with PID 1691 is named pveproxy.
      2. The processes with PIDs 1692, 1693, and 1694 are named pveproxy worker.

      For those wondering, these processes are related to Proxmox VE (Virtual Environment), which is an open-source server virtualization management platform.

      The pveproxy process is the main proxy process, and the pveproxy worker processes are worker processes that handle incoming connections on the specified TCP port (8006).

      6. List Signals

      We can use fuser to send specific signals to a process. To list all signals, run:

      fuser -l

      When you run fuser -l, you will see a complete list of the signals your system supports. This can be helpful when you need to understand the different types of signals available for managing processes.

      HUP INT QUIT ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT
      CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH POLL PWR SYS

      Each of these signals has a specific meaning and use case. Here are some common signals:

      • HUP (1): Hangup detected on controlling terminal or death of controlling process.
      • INT (2): Interrupt from keyboard (like Ctrl+C).
      • QUIT (3): Quit from keyboard.
      • ILL (4): Illegal Instruction.
      • ABRT (6): Abort signal from abort(3).
      • KILL (9): Kill signal (cannot be caught or ignored).
      • SEGV (11): Invalid memory reference.
      • TERM (15): Termination signal.
      • STOP (17, 19, 23): Stop the process (cannot be caught or ignored).
      • CONT (18, 25): Continue if stopped.
      • USR1 (10, 30, 16): User-defined signal 1.
      • USR2 (12, 31, 17): User-defined signal 2.

      These signals can be used in conjunction with other commands (such as kill) to control processes. For instance, you might use kill -9 PID to send a KILL signal to a process with a specific Process ID (PID).

      7. Send a Signal to Processes

      To send a specific signal to a process, use:

      sudo fuser -k -SIGNAL /path/to/file

      For instance, to send the SIGHUP signal to processes accessing a file or directory, you would run:

      sudo fuser -k -HUP /path/to/file_or_directory

      8. Getting Help

      To view the help manual of fuser command, run:

      man fuser

      A Practical Example to Illustrate the Use of fuser Command in Linux

      Suppose you want to unmount a filesystem, but you get an error message saying that the filesystem is busy. You can use the fuser command to find out which processes are using the filesystem and then send a signal to those processes to release the filesystem.

      First, use the fuser command with the -m option to find out which processes are using the mount point. For example, to find out which processes are using the /mnt/data filesystem, you can run the following command:

      sudo fuser -v -m /mnt/data

      This will display a list of process IDs (PIDs) that are using the filesystem.

      Next, you can use the kill command to send a signal to those processes to release the filesystem. For example, to send the SIGTERM signal to those processes, you can run the following command:

      fuser -km /mnt/data

      This will send the SIGTERM signal to all processes that are using the filesystem, giving them a chance to clean up and exit gracefully.

      If the processes do not exit after a few seconds, you can use the SIGKILL signal instead to forcefully terminate the processes:

      fuser -ki /mnt/data

      Note that the -k option is used to send the signal to the processes, and the -i option is used to prompt for confirmation before sending the signal. You can omit the -i option if you want to send the signal immediately.

      Conclusion

      The fuser command is one of the useful tool for managing processes in Linux. It provides detailed information about the processes accessing files, directories, or sockets and allows you to kill or send signals to these processes as needed.

      Especially, the fuser command is a valuable tool for system administrators and users who need to understand which processes are accessing specific resources on their Linux system.

      You May Also Like

      Leave a Comment

      * By using this form you agree with the storage and handling of your data by this website.

      This site uses Akismet to reduce spam. Learn how your comment data is processed.

      This website uses cookies to improve your experience. By using this site, we will assume that you're OK with it. Accept Read More