fuser

Find which processes are accessing a file or directory

$ fuser [path/to/file_or_directory]

$ fuser [[-v|--verbose]] [path/to/file_or_directory]

$ fuser [port]/tcp

$ fuser [[-k|--kill]] [path/to/file_or_directory]

$ fuser [[-m|--mount]] [path/to/file_or_directory]

$ fuser [[-k|--kill]] [port]/tcp

fuser [-aAfimksuvVw] [-n {tcp|udp|unix|udplite|ip|inet|inet6}] [filename|port[{/proto|/udp|/tcp}]

-a
    show all files or ports, even those with no processes

-A
    ignore /proc mount errors

-f
    don't canonicalize pathnames (append filename to output)

-i
    interactive kill; prompt before killing processes

-k
    kill processes accessing the file (SIGKILL)

-l
    list PIDs only, no other info

-m
    show processes using same filesystem as file

-n space
    select namespace: tcp, udp, unix, udplite, ip, inet, inet6

-s
    silent output; just return exit status (0 if any process found)

-u
    show username with each PID

-v
    verbose output including PID, user, command, access type

-w
    kill only processes with writable handles

-4
    search only IPv4 spaces (tcp/ip4, udp/ip4, etc.)

-6
    search only IPv6 spaces (tcp/ip6, udp/ip6, etc.)

-V
    display version information

fuser is a command-line utility in Unix-like systems, including Linux, designed to identify processes accessing specified files, mount points, directories, or network ports. It queries the kernel's file table to list process IDs (PIDs) of processes holding open files or sockets. This makes it invaluable for troubleshooting, such as determining why a filesystem cannot be unmounted, identifying servers bound to specific ports, or locating processes locking files during development or maintenance tasks.

By default, fuser outputs PIDs separated by spaces. Options enhance output with verbose details like user names, command names, and access modes (e.g., cwd for current directory, r for read, w for write, m for mmap). It supports killing processes interactively (-i) or forcefully (-k), and namespace specification (-n tcp|udp|unix) for ports. For filesystems, -m shows all processes on the same device. It works efficiently without needing to parse /proc manually, though full visibility often requires root privileges.

Common scenarios include pre-umount checks (fuser -m /mnt), port usage (fuser 80/tcp), or cleanup (fuser -k /var/log/app.log). It's part of the psmisc package on most distributions.

Requires root for complete process visibility; non-root users see only own processes. Does not work on kernel threads. Killing may fail if processes drop privileges or use different namespaces. Deprecated on some systems in favor of lsof.

fuser -v /home lists processes using /home with details.
fuser -k 22/tcp kills processes on SSH port.
fuser -m -u /mnt/data shows users on filesystem.

0 if processes found; 1 if none; 2 on errors; 129+ if kill signals ignored.

Originated in 4.3BSD (1986). Linux version developed by Werner Almesberger; now in psmisc package since 1993, maintained for compatibility despite lsof alternatives.

lsof(1), kill(1), killall(1), pkill(1), netstat(8), ss(8), ps(1)