fuser - Identify Process Using Files/Ports

fuser(1) - Linux man page

Essential Linux command for troubleshooting file access and network connections:

What fuser Does:

  • File Usage: Shows which processes are accessing specific files
  • Directory Monitoring: Identifies processes with open files in directories
  • Network Analysis: Finds processes using specific network ports
  • Mount Point Investigation: Discovers what’s preventing unmounting

Basic Syntax:

1

fuser [options] file|directory|port

Common Use Cases:

File Access Investigation:

1
2
3
4
5
6
7
8

# Show processes using a file
fuser /var/log/syslog

# Show detailed process information
fuser -v /etc/passwd

# Show processes using files in directory
fuser /home/user/

Network Port Analysis:

1
2
3
4
5
6
7
8

# Find process using TCP port 80
fuser 80/tcp

# Find process using UDP port 53
fuser 53/udp

# Multiple ports at once
fuser 80/tcp 443/tcp

Mount Point Troubleshooting:

1
2
3
4
5

# Why can't I unmount this drive?
fuser -m /mnt/external

# Show all processes with files open on filesystem
fuser -vm /mnt/external

Output Interpretation:

Access Type Indicators:

  • c: Current directory
  • e: Executable being run
  • f: Open file
  • F: Open file for writing
  • r: Root directory
  • m: Memory-mapped file

Example Output:

1
2
3
4

$ fuser -v /var/log/messages
                     USER        PID ACCESS COMMAND
/var/log/messages:   root       1234 f     rsyslogd
                     root       5678 F     logrotate

Powerful Options:

Verbose Mode:

1
2
3
4
5

# Show detailed information
fuser -v filename

# Include user names and process details
fuser -uv filename

Kill Processes:

1
2
3
4
5
6
7
8

# Kill all processes using file (dangerous!)
fuser -k filename

# Interactive kill with confirmation
fuser -ki filename

# Send specific signal
fuser -k -TERM filename

Network Mode:

1
2
3
4
5

# Show all network connections
fuser -n tcp port_number

# UDP connections
fuser -n udp port_number

Practical Scenarios:

“Device is busy” Error:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Can't unmount USB drive
umount /mnt/usb
# umount: /mnt/usb: device is busy

# Find the culprit
fuser -vm /mnt/usb
# Shows: bash (PID 1234) has current directory there

# Fix: change directory and unmount
cd ~
umount /mnt/usb

Port Already in Use:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Development server won't start
# Error: Port 8000 already in use

# Find what's using the port
fuser 8000/tcp
# Output: 8000/tcp: 5432

# Get process details
ps aux | grep 5432
# Kill if necessary
kill 5432

Log File Locked:

1
2
3
4
5
6
7

# Can't edit log file
# Find processes with file open
fuser -v /var/log/application.log

# Safely stop services before editing
systemctl stop application
vi /var/log/application.log

Security and Safety:

Permission Requirements:

  • Root Access: Often needed for system files and other users’ processes
  • Network Ports: Some operations require elevated privileges
  • Process Inspection: Limited to processes you own unless root

Safety Considerations:

  • Kill Command: Use -k option very carefully
  • System Processes: Don’t kill critical system processes
  • Confirmation: Use -i for interactive confirmation when killing

Alternative Commands:

  • lsof: More comprehensive file and process investigation
  • netstat: Network connection analysis
  • ss: Modern replacement for netstat
  • pgrep/pkill: Process finding and killing by name

fuser is invaluable for system administration, debugging file access issues, and understanding what processes are doing on your system.