fuser Linux Command With Examples

Introduction

The fuser command (Find USER) is a process management tool that identifies processes using a file, a directory, or a socket. Additionally, fuser provides information about the process owner and access type and terminates processes in question.

This article will explain how to use the fuser Linux command with examples.

Prerequisites

• A system running Linux.
• Access to the terminal.
• Sudo privileges.

Linux fuser Syntax

The fuser command has a few possible syntax types:

• Options only. Perform an action not specific to a target directory, file, or socket.

fuser [option]

• Specify directory, file, or socket. Locate all processes running in the target path and list their PIDs.

fuser [file_or_directory_or_socket]

• Specify options and directory, file, or socket. Modify the search and perform a specific action on a process. For example, terminate it.

fuser [options] [file_or_directory_or_socket]

• No options. Shows the "No process specification given" message and the help screen.

Linux fuser Options

The fuser command even works when you only specify a file, directory, or socket. Still, using options provides more detailed results.

The table below shows the most common fuser options: 

Command	Description
-v, --verbose	Shows USER, PID, ACCESS, and COMMAND fields instead of only listing PIDs.
-n, --namespace	Changes the namespace from the default value to the new one.
-m, --mount	Specifies a file belonging to a file and lists every process accessing files in that filesystem.
-k, --kill	Kills processes.
-i, --interactive	Asks the user for confirmation before terminating a process.
-[SIGNAL]	Kills processes with the specified signal instead of the default one (SIGKILL).
-l, --list-signals	Lists all signal names that can be used by fuser.
-a, --all	Shows files specified on the command accessed by at least one process.
-u, --user	Adds the process owner's username to each PID.
-4, --ipv4	Searches only for IPv4 sockets.
-6, --ipv6	Search only for IPv6 sockets.
-M, --ismountpoint	Kills processes only if NAME specifies a mount point.
-w	Kill only processes with write access.
-s, --silent	Represents a silent operation ignoring -u and -v options.
-	Resets all options.

Linux fuser Command Examples

The fuser is the ultimate Linux tool for managing processes. To take the most out of the tool, refer to the sections below to see common fuser examples.

Locate Processes in a Directory

The basic fuser role is to identify which processes are using files in a particular directory. The syntax is:

fuser [directory]

For example, to list the processes running in the current directory, use the dot (.):

fuser .

The output lists PIDs of all processes accessing the current directory.

The terminal displays the Home folder as the current one. Therefore, using that folder path prints the same output:

fuser /home/sara

To print a more readable output, use the -v (verbose) option before the directory:

fuser -v .

The same command works on any other directory. For example, identify processes in the WhatIsThis directory placed in the Home folder with:

sudo fuser -v /home/sara/WhatIsThis

The fuser -v . output is detailed and includes the following columns:

• USER - The process owner.
• PID - The process ID.
• ACCESS - The access type.
• COMMAND - The command executing the process.

In the examples above, the access column displays the symbol c, which presents the current directory. Other access types and symbols are:

• e - Executable being run.
• f - Open file.
• F - File open for writing.
• r - Root directory.
• m - mmap'ed file or shared library.

List Processes Using a File

Find processes accessing a file by running fuser with a path to the filename.

fuser -v [filename]

For example, see processes using the this_is_a_new_text file in the Home directory with:

sudo fuser -v /home/sara/this_is_a_new_text

The output shows:

• Root as the process owner.
• Process's PID.
• The access type f representing an open file.
• The command less accessing the file.

The fuser command also works on an executable, like PYTHON3 in the bin directory:

 sudo fuser -v /bin/python3

The command outputs:

• Root as the process owner.
• Process's PID.
• The access symbol e, conveying that the file is an executable.
• The command networkd-dispat running the file.

Locate Processes Using a Socket

To find processes using TCP and UDP sockets, use:

fuser -v -n [socket_type] [port]

Or:

fuser -v [port]/[socket_type]

The -n flag selects the corresponding socket type (TCP or UDP) as a namespace. For instance, identify the process running on TCP port 631 with:

sudo fuser -v -n tcp 631

The shorter syntax is:

sudo fuser -v 631/tcp

In both cases, the command prints the process's PID, F as the access type, and the cupsd command.

Find Process Accessing a Filesystem

Use the -m flag with fuser to identify all processes accessing a filesystem by targeting a file belonging to that system.

For instance, to list all files and processes running in the filesystem to which the this_is_a_new_text file belongs, enter:

sudo fuser -v -m this_is_a_new_text

Kill Processes

The fuser command with the -k flag terminates processes in a selected path. For example, a process is running the this_is_a_new_text file in the Home directory. The file is opened with the command less.

Use fuser -k to kill only the process accessing this file, not every process using the Home directory:

sudo fuser -v -k /home/sara/this_is_a_new_text

The terminal doesn't print anything after either of the two commands. Furthermore, targeting a file with fuser also prints no results. This means that the process is terminated:

sudo fuser -v /home/sara/this_is_a_new_text

To confirm this, check the this_is_a_new_text file previously opened with less:

The output shows the message killed and a new blank terminal line, confirming the process is killed.

Kill Processes Interactively

The flag -k kills any process using a particular file. However, if the namespace is a directory, fuser -k kills all processes accessing that directory. Executing this command in the Home directory without specifying the file, kills the process running the OS and shuts down the system.

To avoid mistakes, run fuser in interactive mode with the -ki option. Kill processes interactively in the Home directory with:

fuser -ki .

The command asks for confirmation every time before killing a process. Therefore, hit y to kill the process and move on to the next, or choose N to skip to the next process.

Send a Signal

When executing fuser with -k, the SIGKILL signal is sent to a process. However, to interrupt the normal fuser -k execution and terminate processes with a different signal, include the -[SIGNAL] flag.

fuser -k -[SIGNAL] [file_or_directory_or_socket]

To list all signals known to fuser, run:

fuser -l

The output shows 31 signals that fuser can use. Hence, when executing fuser -k -[SIGNAL], specify the signal by name or number (-1 to -31). For instance, to allow a process to perform a controlled shutdown, use -TERM or -5 as -[SIGNAL].

For example, to kill the process using TCP port 631 using the TERM signal, execute:

sudo fuser -ki -TERM -n tcp 631

Another option is to use -5 as -[SIGNAL] and 631/TCP as the port name:

sudo fuser -ki -5 631/TCP

The result is the same in both cases. That is, using TERM allows for the soft exit, and the -ki flag asks for confirmation, reducing opportunities for errors.

To check other standard Linux signals' functions and numeric values, run:

man 7 signal

Conclusion

After reading this tutorial, you know how to find a process using a file, directory, or socket or terminate processes with fuser.

Next, learn other ways to kill any process, as well as how to list processes in Linux.