How To Use the Linux Fuser Command
What Is The fuser Command?
The fuser command is a very smart unix utility used to find which process is using a file, a directory or a socket. It also gives information about the user owning the process and the type of access. The fuser tool displays the process id(PID) of every process using the specified files or file systems.
How To Use The fuser Utility?
The man command can be used to see manual pages for any command, but the best way to learn something new, especially linux commands, is by going through real world examples and never stop typing commands in the terminal. Run the following command in your terminal to get information about the usage options of the fuser utility. We will be experimenting with the fuser utility on a Ubuntu 12.04 VPS. However, as long as you are running a linux distribution it should be okay.
fuser
root@exampleuser-X55CR:~# fuser
No process specification given
Usage: fuser [-fMuv] [-a|-s] [-4|-6] [-c|-m|-n SPACE] [-k [-i] [-SIGNAL]] NAME...
fuser -l
fuser -V
Show which processes use the named files, sockets, or filesystems.
-a,--all display unused files too
-i,--interactive ask before killing (ignored without -k)
-k,--kill kill processes accessing the named file
-l,--list-signals list available signal names
-m,--mount show all processes using the named filesystems or block device
-M,--ismountpoint fulfill request only if NAME is a mount point
-n,--namespace SPACE search in this name space (file, udp, or tcp)
-s,--silent silent operation
-SIGNAL send this signal instead of SIGKILL
-u,--user display user IDs
-v,--verbose verbose output
-w,--writeonly kill only processes with write access
-V,--version display version information
-4,--ipv4 search IPv4 sockets only
-6,--ipv6 search IPv6 sockets only
- reset options
udp/tcp names: [local_port][,[rmt_host][,[rmt_port]]]
How To View Processes Using A Directory
The fuser utility can be used with -v option, which runs the tool in verbose mode. The verbose option is used to produce verbose output on the computer screen so the user can see real-time status of what the utility is doing.
root@exampleuser-X55CR:~# fuser -v .
USER PID ACCESS COMMAND
/root: root 3378 ..c.. vim
root 3398 ..c.. bash
root 3449 ..c.. bash
root 19370 ..c.. bash
root@exampleuser-X55CR:~#
The above output shows that, when ran in verbose mode, the fuse utility gives information about the USER, PID, ACCESS and COMMAND. The ‘c’ character under ACCESS shows the type of access, it means ‘current directory’. There are many access types such as e(executable being run), r(root directory), f(open file. f is omitted in default display mode), F(open file for writing, F is omitted in default display mode) and m (mmap’ed file or shared library).
What process is using your tcp or udp socket?
There are times when you need to look up processes using TCP and UDP sockets. In order to look up these processes, the usage of -n option is needed. The -n option is used to select the corresponding name space.The following command creates a tcp listener on port 80.
root@exampleuser-X55CR:~# nc -l -p 80
Since a tcp server is listening on port 80, the fuser utility can be used to find the process which is using the server’s socket. The -v option is used to put the fuser utility in verbose mode and the -n option is used to select the tcp protocol as a name space.
root@exampleuser-X55CR:~# fuser -v -n tcp 80
root@exampleuser-X55CR:~# fuser -v -n tcp 80
USER PID ACCESS COMMAND
80/tcp: root 3846 F.... nc
root@exampleuser-X55CR:~#
By default, the fuser tool will look in both IPv6 and IPv4 sockets, but the default option can be changed with the -4 and -6 options. The -4 option stands for IPv4, the -6 one stands for IPv6. Note that fuser outputs only the PIDs to stdout, everything else is sent to stderr.
The results of the ‘fuser -v -n tcp 80’ command show that process id of the process using netcat is 3846 and the command which was used to launch it is ‘nc’. The process id (PID) can be used in many ways, one of them is process killing. When used with a PID, the kill command kills a process based on that process id. The fuser utility can also be used to kill processes accessing a specific file. In the following command, the -k option is used to kill the process which is using the tcp listener running on port 123. To make sure that the user does not kill a wrong process, the -i option is used which asks the user for confirmation before killing a process.
root@exampleuser-X55CR:~# fuser -k 123/tcp
123/tcp: 11543
Use the ‘fuser -k’ command with the -i option to ask the user for confirmation before killing a process. The user can answer with y for yes or N for not confirming the killing.
root@exampleuser-X55CR:~# fuser -i -k 123/tcp
123/tcp: 12216
Kill process 12216 ? (y/N)
Use The -6 Option To Look For IPv6 Sockets.
The following command uses fuser tool in verbose mode and tries to find IPv6 sockets running on port 123.
root@exampleuser-X55CR:~# fuser -v -n tcp -6 123
Since there is no IPv6 socket running on port 123, the command does not produce any output. The -6 option can be replaced with the -4 option in order to search for IPv4 sockets running on a specific port.
Find The Process Accessing A File System
The -m option can be used with the fuser command to find processes accessing files on the filesystem of a file. This option requires a filename as input argument. The -m option is very useful, especially when used to discover processes accessing a file system with the intetion of identifying which process to kill.
The following command displays all processes accessing filesystem on which ‘example.txt’ resides. See carefully how the -m option is used with the fuser utility.
root@exampleuser-X55CR:~# fuser -v -m example.txt
USER PID ACCESS COMMAND
/root/example.txt: root kernel mount /
root 1 Frce. init
root 2 .rc.. kthreadd
root 3 .rc.. ksoftirqd/0
root 6 .rc.. migration/0
root 7 .rc.. watchdog/0
[...]
exampleuser 23347 .r.e. gcalctool
exampleuser 24527 f..e. chrome
exampleuser 25388 f..e. chrome
exampleuser 25628 .r.e. evince
exampleuser 25634 .rce. evinced
exampleuser 25706 .rce. gm-notify
exampleuser 25769 .rce. at-spi-bus-laun
exampleuser 28191 .rce. mate-settings-d
exampleuser 28193 .rce. mate-screensave
exampleuser 29942 f..e. chrome
exampleuser 30044 .r.e. evince
exampleuser 32721 f..e. chrome
The fuser utility can also be used to send specific signals to a process. When used with the -k option, the fuser command sends the KILL signal to a process. There are many signals which can be sent to a specific running process; the -l option helps to find the list of signals that can be used with the fuser tool.
root@exampleuser-X55CR:~# fuser -l
HUP INT QUIT ILL TRAP ABRT IOT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM
STKFLT CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH IO PWR SYS
UNUSED
The above output shows all the possible signals that can be used with the fuser tool.
Conclusion
Of course this article is not enough to cover all options and practical examples of the fuser tool, but every example served in this article will help you in your way to being a Linux ninja.