How To Use the Linux Fuser

How To Use the Linux Fuser Command

Tags: System Tools

What Is The fuser Command?

The fuser command is a very smart unix utility used to find which process is using a file, a directory or a socket. It also gives information about the user owning the process and the type of access. The fuser tool displays the process id(PID) of every process using the specified files or file systems.

How To Use The fuser Utility?

The man command can be used to see manual pages for any command, but the best way to learn something new, especially linux commands, is by going through real world examples and never stop typing commands in the terminal. Run the following command in your terminal to get information about the usage options of the fuser utility. We will be experimenting with the fuser utility on a Ubuntu 12.04 VPS. However, as long as you are running a linux distribution it should be okay.

fuser

root@exampleuser-X55CR:~# fuser 
No process specification given
Usage: fuser [-fMuv] [-a|-s] [-4|-6] [-c|-m|-n SPACE] [-k [-i] [-SIGNAL]] NAME...
       fuser -l
       fuser -V
Show which processes use the named files, sockets, or filesystems.

  -a,--all              display unused files too
  -i,--interactive      ask before killing (ignored without -k)
  -k,--kill             kill processes accessing the named file
  -l,--list-signals     list available signal names
  -m,--mount            show all processes using the named filesystems or block device
  -M,--ismountpoint     fulfill request only if NAME is a mount point
  -n,--namespace SPACE  search in this name space (file, udp, or tcp)
  -s,--silent           silent operation
  -SIGNAL               send this signal instead of SIGKILL
  -u,--user             display user IDs
  -v,--verbose          verbose output
  -w,--writeonly        kill only processes with write access
  -V,--version          display version information
  -4,--ipv4             search IPv4 sockets only
  -6,--ipv6             search IPv6 sockets only
  -                     reset options

  udp/tcp names: [local_port][,[rmt_host][,[rmt_port]]]

How To View Processes Using A Directory

The fuser utility can be used with -v option, which runs the tool in verbose mode. The verbose option is used to produce verbose output on the computer screen so the user can see real-time status of what the utility is doing.

root@exampleuser-X55CR:~# fuser -v .
                     USER        PID ACCESS COMMAND
/root:               root       3378 ..c.. vim
                     root       3398 ..c.. bash
                     root       3449 ..c.. bash
                     root      19370 ..c.. bash
root@exampleuser-X55CR:~#

The above output shows that, when ran in verbose mode, the fuse utility gives information about the USER, PID, ACCESS and COMMAND. The ‘c’ character under ACCESS shows the type of access, it means ‘current directory’. There are many access types such as e(executable being run), r(root directory), f(open file. f is omitted in default display mode), F(open file for writing, F is omitted in default display mode) and m (mmap’ed file or shared library).

What process is using your tcp or udp socket?

There are times when you need to look up processes using TCP and UDP sockets. In order to look up these processes, the usage of -n option is needed. The -n option is used to select the corresponding name space.The following command creates a tcp listener on port 80.

root@exampleuser-X55CR:~# nc -l -p 80
Since a tcp server is listening on port 80, the fuser utility can be used to find the process which is using the server’s socket. The -v option is used to put the fuser utility in verbose mode and the -n option is used to select the tcp protocol as a name space.

root@exampleuser-X55CR:~# fuser -v -n tcp 80
root@exampleuser-X55CR:~# fuser -v -n tcp 80
                     USER        PID ACCESS COMMAND
80/tcp:              root       3846 F.... nc
root@exampleuser-X55CR:~#

By default, the fuser tool will look in both IPv6 and IPv4 sockets, but the default option can be changed with the -4 and -6 options. The -4 option stands for IPv4, the -6 one stands for IPv6. Note that fuser outputs only the PIDs to stdout, everything else is sent to stderr.

The results of the ‘fuser -v -n tcp 80’ command show that process id of the process using netcat is 3846 and the command which was used to launch it is ‘nc’. The process id (PID) can be used in many ways, one of them is process killing. When used with a PID, the kill command kills a process based on that process id. The fuser utility can also be used to kill processes accessing a specific file. In the following command, the -k option is used to kill the process which is using the tcp listener running on port 123. To make sure that the user does not kill a wrong process, the -i option is used which asks the user for confirmation before killing a process.

root@exampleuser-X55CR:~# fuser -k  123/tcp
123/tcp:             11543

Use the ‘fuser -k’ command with the -i option to ask the user for confirmation before killing a process. The user can answer with y for yes or N for not confirming the killing.

root@exampleuser-X55CR:~# fuser -i -k 123/tcp
123/tcp:             12216
Kill process 12216 ? (y/N)
Use The -6 Option To Look For IPv6 Sockets.

The following command uses fuser tool in verbose mode and tries to find IPv6 sockets running on port 123.

root@exampleuser-X55CR:~# fuser -v -n tcp -6 123
Since there is no IPv6 socket running on port 123, the command does not produce any output. The -6 option can be replaced with the -4 option in order to search for IPv4 sockets running on a specific port.

Find The Process Accessing A File System

The -m option can be used with the fuser command to find processes accessing files on the filesystem of a file. This option requires a filename as input argument. The -m option is very useful, especially when used to discover processes accessing a file system with the intetion of identifying which process to kill.

The following command displays all processes accessing filesystem on which ‘example.txt’ resides. See carefully how the -m option is used with the fuser utility.

root@exampleuser-X55CR:~# fuser -v -m example.txt 
                     USER        PID ACCESS COMMAND
/root/example.txt:   root     kernel mount /
                     root          1 Frce. init
                     root          2 .rc.. kthreadd
                     root          3 .rc.. ksoftirqd/0
                     root          6 .rc.. migration/0
                     root          7 .rc.. watchdog/0
                    [...]
                    exampleuser   23347 .r.e. gcalctool
                    exampleuser   24527 f..e. chrome
                    exampleuser   25388 f..e. chrome
                    exampleuser   25628 .r.e. evince
                    exampleuser   25634 .rce. evinced
                    exampleuser   25706 .rce. gm-notify
                    exampleuser   25769 .rce. at-spi-bus-laun
                    exampleuser   28191 .rce. mate-settings-d
                    exampleuser   28193 .rce. mate-screensave
                    exampleuser   29942 f..e. chrome
                    exampleuser   30044 .r.e. evince
                    exampleuser   32721 f..e. chrome

The fuser utility can also be used to send specific signals to a process. When used with the -k option, the fuser command sends the KILL signal to a process. There are many signals which can be sent to a specific running process; the -l option helps to find the list of signals that can be used with the fuser tool.

root@exampleuser-X55CR:~# fuser -l
HUP INT QUIT ILL TRAP ABRT IOT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM
STKFLT CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH IO PWR SYS
UNUSED

The above output shows all the possible signals that can be used with the fuser tool.

Conclusion

Of course this article is not enough to cover all options and practical examples of the fuser tool, but every example served in this article will help you in your way to being a Linux ninja.