fuser - identify processes using files or sockets
fuser [-a|-s|-c] [-4|-6] [-n space ] [-k [-i] [-signal ] ] [-muvf]
fuser displays the PIDs of processes using the specified files or file systems. In the default display mode, each file name is followed by a letter denoting the type of access:
fuser returns a non-zero return code if none of the specified files is accessed or in case of a fatal error. If at least one access has been found, fuser returns zero.
In order to look up processes using TCP and UDP sockets, the corresponding name space has to be selected with the -n option. By default fuser will look in both IPv6 and IPv4 sockets. To change the default, behavior, use the -4 and -6 options. The socket(s) can be specified by the local and remote port, and the remote address. All fields are optional, but commas in front of missing fields must be present:
Either symbolic or numeric values can be used for IP addresses and port numbers.
fuser outputs only the PIDs to stdout, everything else is sent to stderr.
fuser -km /home kills all processes accessing the file system /home in any way.
if fuser -s /dev/ttyS1; then :; else something; fi invokes something if no other process is using /dev/ttyS1.
fuser telnet/tcp shows all processes at the (local) TELNET port.
Processes accessing the same file or file system several times in the same way are only shown once.
If the same object is specified several times on the command line, some of those entries may be ignored.
fuser may only be able to gather partial information unless run with privileges. As a consequence, files opened by processes belonging to other users may not be listed and executables may be classified as mapped only.
Installing fuser SUID root will avoid problems associated with partial information, but may be undesirable for security and privacy reasons.
udp and tcp name spaces, and UNIX domain sockets can’t be searched with kernels older than 1.3.78.
udp and tcp currently work with IPv6 and IPv4, but the address fields can only be IPv4 addresses.
Accesses by the kernel are only shown with the -v option.
The -k option only works on processes. If the user is the kernel, fuser will print an advice, but take no action beyond that.
fuser -m /dev/sgX will show (or kill with the -k flag) all processes, even if you don’t have that device configured. There may be other devices it does this for too.
fuser cannot report on any processes that it doesn’t have permission to look at the file descriptor table for. The most common time this problem occurs is when looking for TCP or UDP sockets when running fuser as a non-root user. In this case fuser will report no access
Werner Almesberger <firstname.lastname@example.org>
Craig Small <email@example.com>
kill(1) , killall(1) , lsof(8) , ps(1) , kill(2) .
Table of Contents