The fuser utility that comes preinstalled with Linux is a very powerful tool. As the name suggests, it provides information about the user or about the process that uses a particular file or directory.
The functionality of the fuser utility is not limited to providing information about processes. The basic utility of the command fuser is to identify which processes use a particular file or directory.
fuser ./:
3965c 4175c 4281c 4334c 4337c
In the example above, the fuser utility was run to find all processes using the current directory ‘./’ ‘
We note that the output of the command consists of a process identifier enumeration (PIDs), but the ‘c’ character follows all PIDs. It indicates the type of access. The type of access can be:
c current directory
e is the executable running
f open file. f is omitted in the default display mode
F file open for writing. F is omitted in the default display mode
r root directory
m mmap file or shared library
‘C’ communicates that the listed processes use the directory as the current directory.
Use the ‘-v’ option to get detailed information:
$ fuser -v ./
USER PID ACCESS COMMAND
./: username 3965 ..c .. bash
username 4175 ..c .. gedit
username 4281 ..c .. bash
username 4334 ..c .. socket_serv
username 4337 ..c .. bash
We can see that the running of the fuser command having the current directory parameter lets you learn more about the processes that use this directory.
The fuser command has an executable parameter.
Socket_serv is an executable (a C written program that listens on a TCP port)
./socket_serv
If we call the fuser command with this executable parameter we will get the following output:
fuser -in socket_serv
USER PID ACCESS COMMAND
socket_serv: username 4334 … e. socket_serv
In this case, ‘e’ indicates that the file is executable.
It sometimes happens that we need to make a partition umount and can not because it’s used. Sometimes it is easy to identify the process that uses it, but sometimes the answer is far from obvious.
To detect which processes use a particular partition, we can use the fuser utility in the psmisc packet.
Suppose we have the following situation:
umount / dev / sda5
umount: / media / sda5: device is busy
umount: / media / sda5: device is busy
In this case, the sda5 partition is used, and we need to find out which process must be shut down so that it can be dismantled. We use fuser:
fuser -m / dev / sda5
/ dev / sda5: 21019c
This means that the process with pid 21019 is responsible for using the partition.
Now we need to find out what the process is and what user is running it.
ps aux | grep “21019”
We’ll see something like this:
root 21019 0.0 0.0 4032 1780 ttyp0 S 13:47 0:00 bash
That means a shell keeps the partition busy. We’re most likely in the directory where the partition is mounted, and that’s why it can not be umount. We can either get out of the directory, or kill the -9 pid of the responsible process. The situation varies from case to case, preferring would be to close the process without using kill.
This method is extremely useful to prevent the removal of a non-umount stick or blocking a CD in the drive.
Checking processes using TCP / UDP sockets
Using the fuser command we can also check which processes use TCP / UDP sockets. The above program, socket_serv, opens the TCP 5000 port.
We can use the fuser command with the tcp port parameter.
fuser -v -n tcp 5000
USER PID ACCESS COMMAND
5000 / tcp: username 4334 F socket_serv
We’ll get detailed information about the process running on port 5000.
In addition to the cases presented, we can use the ‘-m’ parameter to display all processes using mounted file systems.