fuser - Identify Process Using Files/Ports
fuser(1) - Linux man page
Essential Linux command for troubleshooting file access and network connections:
What fuser Does:
- File Usage: Shows which processes are accessing specific files
- Directory Monitoring: Identifies processes with open files in directories
- Network Analysis: Finds processes using specific network ports
- Mount Point Investigation: Discovers what’s preventing unmounting
Basic Syntax:
1
| fuser [options] file|directory|port
|
Common Use Cases:
File Access Investigation:
1
2
3
4
5
6
7
8
| # Show processes using a file
fuser /var/log/syslog
# Show detailed process information
fuser -v /etc/passwd
# Show processes using files in directory
fuser /home/user/
|
Network Port Analysis:
1
2
3
4
5
6
7
8
| # Find process using TCP port 80
fuser 80/tcp
# Find process using UDP port 53
fuser 53/udp
# Multiple ports at once
fuser 80/tcp 443/tcp
|
Mount Point Troubleshooting:
1
2
3
4
5
| # Why can't I unmount this drive?
fuser -m /mnt/external
# Show all processes with files open on filesystem
fuser -vm /mnt/external
|
Output Interpretation:
Access Type Indicators:
- c: Current directory
- e: Executable being run
- f: Open file
- F: Open file for writing
- r: Root directory
- m: Memory-mapped file
Example Output:
1
2
3
4
| $ fuser -v /var/log/messages
USER PID ACCESS COMMAND
/var/log/messages: root 1234 f rsyslogd
root 5678 F logrotate
|
Powerful Options:
Verbose Mode:
1
2
3
4
5
| # Show detailed information
fuser -v filename
# Include user names and process details
fuser -uv filename
|
Kill Processes:
1
2
3
4
5
6
7
8
| # Kill all processes using file (dangerous!)
fuser -k filename
# Interactive kill with confirmation
fuser -ki filename
# Send specific signal
fuser -k -TERM filename
|
Network Mode:
1
2
3
4
5
| # Show all network connections
fuser -n tcp port_number
# UDP connections
fuser -n udp port_number
|
Practical Scenarios:
“Device is busy” Error:
1
2
3
4
5
6
7
8
9
10
11
| # Can't unmount USB drive
umount /mnt/usb
# umount: /mnt/usb: device is busy
# Find the culprit
fuser -vm /mnt/usb
# Shows: bash (PID 1234) has current directory there
# Fix: change directory and unmount
cd ~
umount /mnt/usb
|
Port Already in Use:
1
2
3
4
5
6
7
8
9
10
11
| # Development server won't start
# Error: Port 8000 already in use
# Find what's using the port
fuser 8000/tcp
# Output: 8000/tcp: 5432
# Get process details
ps aux | grep 5432
# Kill if necessary
kill 5432
|
Log File Locked:
1
2
3
4
5
6
7
| # Can't edit log file
# Find processes with file open
fuser -v /var/log/application.log
# Safely stop services before editing
systemctl stop application
vi /var/log/application.log
|
Security and Safety:
Permission Requirements:
- Root Access: Often needed for system files and other users’ processes
- Network Ports: Some operations require elevated privileges
- Process Inspection: Limited to processes you own unless root
Safety Considerations:
- Kill Command: Use
-k option very carefully - System Processes: Don’t kill critical system processes
- Confirmation: Use
-i for interactive confirmation when killing
Alternative Commands:
- lsof: More comprehensive file and process investigation
- netstat: Network connection analysis
- ss: Modern replacement for netstat
- pgrep/pkill: Process finding and killing by name
fuser is invaluable for system administration, debugging file access issues, and
understanding what processes are doing on your system.
