FUSER(1)

🎀 FUSER(1) 🎀

User Commands section, bestie. This is the manual page for fuser, and it is an absolute icon 💅

✨ NAME ✨

fuser - identify processes using files or sockets 🔍

🌸 SYNOPSIS 🌸

fuser [-fuv] [-a|-s] [-4|-6] [-c|-m|-n space] [ -k [-i] [-M] [-w]
[-SIGNAL] ] name ...
fuser -l
fuser -V

💖 DESCRIPTION 💖

okay so fuser shows you the PIDs of whatever processes are using the files or file systems you point it at. 🦋 In the default display mode, every file name gets a letter after it that tells you how that process is using it. it's giving detective energy, honestly ✨

• c — current directory.
• e — executable being run.
• f — open file. f is left out in default display mode.
• F — open file for writing. F is left out in default display mode.
• r — root directory.
• m — mmap'ed file or shared library.
• . — placeholder, left out in default display mode.

fuser returns a non-zero return code if none of the files you gave it are accessed, or if something goes wrong and it's a fatal error. 😭 If at least one access gets found, fuser returns zero. that's the vibe ✅

now for the socket girlies 🧚 to look up processes using TCP and UDP sockets, you have to pick the matching name space with the -n option. by default, fuser looks in both IPv6 and IPv4 sockets. if you want to change that, use the -4 and -6 options. you can point at a socket using its local and remote port, plus the remote address. every field is optional, but the commas in front of any missing fields still have to be there, no cap 🫶

[lcl_port][,[rmt_host][,[rmt_port]]]

You can use symbolic or numeric values for IP addresses and port numbers. both are valid, so you do you 🌈

and lowkey important: fuser only sends the PIDs to stdout. everything else gets sent to stderr 💜

🎀 OPTIONS 🎀

• -a, --all — show all the files you listed on the command line. by default, only files that at least one process is actually accessing get shown 👀
• -c — same as the -m option. it's here for POSIX compatibility, so it's giving "official" energy 📜
• -f — silently ignored. it's only here for POSIX compatibility, so don't stress about it 🙈
• -k, --kill — kills the processes accessing the file 💀 unless you change it with -SIGNAL, the signal sent is SIGKILL. an fuser process never kills itself, but it can kill other fuser processes (chaotic but valid). before it tries to kill anything, the effective user ID of the process running fuser gets set to its real user ID 🔐
• -i, --interactive — asks you to confirm before killing each process. this one gets silently ignored if -k isn't there too, so it needs its bestie 🫂
• -I, --inode — for the name space file, every comparison is based on the inodes of the file(s) you specified, and never on the file names. this applies even on network based file systems ✨
• -l, --list-signals — lists every known signal name 📋
• -m NAME, --mount NAME — NAME is a file on a mounted file system, or a block device that's mounted. all processes accessing files on that file system get listed. if you give it a directory, it's automatically changed to NAME/ so it can catch any file system that might be mounted on that directory 🗂️
• -M, --ismountpoint — your request only gets fulfilled if NAME is actually a mountpoint. this is an invaluable seat belt 🪢 because it stops you from accidentally killing the whole machine if NAME turns out not to be a filesystem 😱
• -w — kills only processes with write access. this one gets silently ignored if -k isn't there too 🔥
• -n NAMESPACE, --namespace NAMESPACE — picks a different name space. the ones that are supported are file (file names, the default), udp (local UDP ports), and tcp (local TCP ports). for ports, you can use either the port number or the symbolic name. if there's no ambiguity, you can use the shortcut name/space notation, like 80/tcp 🎯
• -s, --silent — silent operation. -u and -v are ignored in this mode. you must not use -a with -s ❌
• -SIGNAL — sends the signal you name instead of SIGKILL when killing processes. you can say the signal by name (like -HUP) or by number (like -1). this gets silently ignored if you don't use -k ⚡
• -u, --user — tacks the user name of the process owner onto each PID 🧑‍🤝‍🧑
• -v, --verbose — verbose mode, where processes show up in a ps-like style 💅 the PID, USER and COMMAND fields are similar to ps. ACCESS shows how the process is accessing the file. verbose mode also shows when a file is being accessed as a mount point, knfs export or swap file. in that case, kernel shows up instead of a PID 🧠
• -V, --version — displays version information 🏷️
• -4, --ipv4 — searches only IPv4 sockets. this must not be used together with -6, and it only does anything with the tcp and udp name spaces 🌐
• -6, --ipv6 — searches only IPv6 sockets. this must not be used together with -4, and it only does anything with the tcp and udp name spaces 🌍

🧚 FILES 🧚

• /proc — location of the proc file system 📂

🍓 EXAMPLES 🍓

fuser -km /home

kills all processes accessing the file system /home in any way. 💀 (big yikes energy, use wisely)

if fuser -s /dev/ttyS1; then :; else command; fi

invokes command if no other process is using /dev/ttyS1. so smart 🧠

fuser telnet/tcp

shows all processes at the (local) TELNET port. 📞

🚧 RESTRICTIONS 🚧

⚠️ heads up bestie, these are the limits. read them, they matter.

Processes accessing the same file or file system several times in the same way are only shown once. 👯

If the same object is specified several times on the command line, some of those entries may be ignored. 🙃

fuser may only be able to gather partial information unless it's run with privileges. as a result, files opened by processes belonging to other users may not be listed, and executables may be classified as mapped only. 😤

fuser cannot report on any processes that it doesn't have permission to look at the file descriptor table for. the most common time this happens is when you're looking for TCP or UDP sockets while running fuser as a non-root user. in that case, fuser will report no access 🥲

Installing fuser SUID root will avoid the problems that come with partial information, but it may be undesirable for security and privacy reasons 🔒

udp and tcp name spaces, and UNIX domain sockets can't be searched with kernels older than 1.3.78 🦖

Accesses by the kernel are only shown with the -v option. 🫣

The -k option only works on processes. if the user is the kernel, fuser will print an advice, but it won't take any action beyond that 🤷‍♀️

fuser will not see block devices mounted by processes in a different mount namespace. this is because the device ID shown in the process' file descriptor table comes from the process namespace, not fuser's. so it won't match 🙅‍♀️

🐛 BUGS 🐛

🪲 these are known bugs, so be careful out there

fuser -m /dev/sgX will show (or kill with the -k flag) all processes, even if you don't have that device configured. there may be other devices it does this for too 😬

The -m option will match any file within the same device as the specified file. if you only mean to specify the mount point, use the -M option as well 🎯

fuser will not match mapped files, such as a process' shared libraries, if they're on a btrfs(5) filesystem. that's because the device IDs are different for stat(2) and /proc/<PID>/maps 💔

🦋 SEE ALSO 🦋

kill(1), killall(1), stat(2), btrfs(5), lsof(8), mount_namespaces(7), pkill(1), ps(1), kill(2) 📚

---

that's the whole tea, bestie 🫶 psmisc 2022-11-02 FUSER(1) 💖✨