FUSER Command in Linux

FUSER is a Linux command that enlists all the processes which  are using a particular file/directory. Not only the processes, the details about the owner of the process, the Access Type and the PID (Process ID) are also provided.

In most of the articles on Linux Commands, I have quoted that "The most basic use of any command is when it is executed without any arguments". Lets check if it is true in the case of fuser:

mandar@LinuxBox:~$ fuser
No process specification given
Usage: fuser [-fMuv] [-a|-s] [-4|-6] [-c|-m|-n SPACE] [-k [-i] [-SIGNAL]] NAME...
       fuser -l
       fuser -V
Show which processes use the named files, sockets, or filesystems.

  -a,--all              display unused files too
  -i,--interactive      ask before killing (ignored without -k)
  -k,--kill             kill processes accessing the named file
  -l,--list-signals     list available signal names
  -m,--mount            show all processes using the named filesystems or block device
  -M,--ismountpoint     fulfill request only if NAME is a mount point
  -n,--namespace SPACE  search in this name space (file, udp, or tcp)
  -s,--silent           silent operation
  -SIGNAL               send this signal instead of SIGKILL
  -u,--user             display user IDs
  -v,--verbose          verbose output
  -w,--writeonly        kill only processes with write access
  -V,--version          display version information
  -4,--ipv4             search IPv4 sockets only
  -6,--ipv6             search IPv6 sockets only
  -                     reset options

  udp/tcp names: [local_port][,[rmt_host][,[rmt_port]]]

No, it needs an argument and all the available options are displayed before you. How to use them, lets see.

The most basic use of fuser command is to determine which processes are using a particular file/directory. In this case, just provide file/directory name as an argument to the fuser command.

fuser [FILE/DIRECTORY-NAME]

Example:
Lets see the processes that are using my 'home' directory:

mandar@LinuxBox:~$ fuser ~
/home/mandar:         1437c  1484c  1503c  1520c  1521c  1526c  1527c  1531c  1536c  1537c  1649c  1661c  1679c  1682c  1797c  1819c  1875c  1938c  2461c

So, here is the list of PIDs. But what about that extra 'c' character?

The 'c' character indicates the Access type, and there are several types of access, which are:

• c - Current Directory
• e - Executable
• f - Open file for reading
• F - Open file for writing
• r - Root directory
• m - Memory Mapped File/Directory

So, if we wish to check for the root directory, the output would look like:

mandar@LinuxBox:~$ fuser /
/:                    1437r  1475rc  1476rc  1484r  1495rc  1497rc  1503r  1512rc  1517rc  1519rc  1520r  1521r  1526r  1527r  1529rc  1531r  1536r  1537r  1547rc  1556rc  1560rc  1565rc  1570rc  1577rc  1584rc  1586rc  1588rc  1590rc  1593rc  1595rc  1597rc  1627rc  1647rc  1649r  1661r  1669rc  1679r  1682r  1684rc  1691rc  1696rc  1701rc  1710rc  1715rc  1718rc  1719rc  1721rc  1766rc  1794rc  1797r  1819r  1875r  1938r  2461r  2477rc  2991rc

Above commands will just display PIDs and Access types of the processes, for more detailed version, you can use option -v as follows:

mandar@LinuxBox:/$ fuser -v ~
                     USER        PID ACCESS COMMAND
/home/mandar:        mandar     1437 ..c.. gnome-session
                     mandar     1484 ..c.. gnome-settings-
                     mandar     1503 ..c.. metacity
                     mandar     1520 ..c.. unity-2d-panel
                     mandar     1521 ..c.. unity-2d-shell
                     mandar     1526 ..c.. nm-applet
                     mandar     1527 ..c.. gnome-fallback-
                     mandar     1531 ..c.. polkit-gnome-au
                     mandar     1536 ..c.. nautilus
                     mandar     1537 ..c.. bluetooth-apple
                     mandar     1649 ..c.. gdu-notificatio
                     mandar     1661 ..c.. telepathy-indic
                     mandar     1679 ..c.. gnome-screensav
                     mandar     1682 ..c.. zeitgeist-datah
                     mandar     1797 ..c.. gnome-terminal
                     mandar     1875 ..c.. update-notifier
                     mandar     1938 ..c.. deja-dup-monito
                     mandar     2461 ..c.. firefox

Another use of fuser is to show the processes using a particular TCP/UDP socket. To create a process that listens to TCP port 8080, netcat command can be executed as follows:

mandar@LinuxBox:~$ nc -l localhost 8080 &
[1] 4421

Now, let us execute fuser with option -n as follows:

mandar@LinuxBox:/$ fuser -v -n tcp 8080
                     USER        PID ACCESS COMMAND
8080/tcp:            mandar     4421 F.... nc

You can easily verify the output looking at the PID of the listed process.

Now, in order to kill this TCP listener, you can use option -k. When this option -k is used along with option -i, it will as you for the confirmation before directly killing the process. Here is the example:

mandar@LinuxBox:~$ fuser -i -k 8080/tcp
8080/tcp:             4421
Kill process 4421 ? (y/N) y
[1]+  Killed                  nc -l localhost 8080

If you don't use option -i, the case would be as follows:

mandar@LinuxBox:~$ fuser -k 8080/tcp
8080/tcp:             4421
[1]+  Killed                  nc -l localhost 8080

Apart from the KILL signal, you can send variety of signals that can be listed using option -l as follows:

mandar@LinuxBox:~$ fuser -l
HUP INT QUIT ILL TRAP ABRT IOT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM
STKFLT CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH IO PWR SYS
UNUSED

So, in order to STOP a process, you would execute:

mandar@LinuxBox:~$ fuser -i -k STOP [FILE/DIRECTORY]

This will ask for your confirmation before deleting each process using the File/Directory Name specified.