How To Use the Linux Fuser Command

Introduction #

The fuser command is a Linux utility designed to find which process is using a given file, directory, or socket. It also provides information about the user owning running that process, and the type of access.

How To Use The fuser Utility #

You can review the fuser manual page to get an overview of all of the options to use with fuser. You can also run fuser on its own without any options to get an overview of fuser syntax:

fuser

No process specification given
Usage: fuser [-fMuv] [-a|-s] [-4|-6] [-c|-m|-n SPACE] [-k [-i] [-SIGNAL]] NAME...
       fuser -l
       fuser -V
Show which processes use the named files, sockets, or filesystems.

  -a,--all              display unused files too
  -i,--interactive      ask before killing (ignored without -k)
  -k,--kill             kill processes accessing the named file
  -l,--list-signals     list available signal names
  -m,--mount            show all processes using the named filesystems or block device
  -M,--ismountpoint     fulfill request only if NAME is a mount point
  -n,--namespace SPACE  search in this name space (file, udp, or tcp)
  -s,--silent           silent operation
  -SIGNAL               send this signal instead of SIGKILL
  -u,--user             display user IDs
  -v,--verbose          verbose output
  -w,--writeonly        kill only processes with write access
  -V,--version          display version information
  -4,--ipv4             search IPv4 sockets only
  -6,--ipv6             search IPv6 sockets only
  -                     reset options

  udp/tcp names: [local_port][,[rmt_host][,[rmt_port]]]

How To View Processes Running in a Directory #

fuser can also be used with -v option, which runs the tool in verbose mode. The verbose option is used to produce more output so the user can observe what fuser is doing. Run fuser on the current directory, ., while including the -v option:

fuser -v .

                     USER        PID ACCESS COMMAND
/home/sammy:         sammy     17604 ..c.. bash

In this case, the only process running in this directory is the interactive bash shell that you are running commands from right now.
When run in verbose mode, the fuser utility gives information about the USER, PID, ACCESS and COMMAND of a process. The c character under ACCESS shows the type of access, in this case meaning the current directory. There are other access types, such as executable being run, root directory, open file, and mapped file or shared library.

How to Find Processes Using Network Sockets #

You may also need to look up processes using TCP and UDP sockets. To demonstrate this example, you’ll first use nc to create a TCP listener on port 8002, so that there is a running process you can observe:

nc -l -p 8002

This will block the terminal as long as it’s running. In another terminal window, use fuser to find the process running on TCP port 8002 with the -n option:

fuser -v -n tcp 8002

                     USER        PID ACCESS COMMAND
8002/tcp:            sammy     17985 F.... nc

Note: By default, the fuser tool will check both IPv4 and IPv6 sockets, but you can change this with the -4 and -6 options to check only IPv4 or only IPv6 connections, respectively.

This output shows that the process id (PID) of the process using netcat is 17985 and the command which was used to launch it is ‘nc’. The process id (PID) can be used in many ways, including to stop or kill a running process. You can learn more about process management by reading How To Use ps, kill, and nice to Manage Processes in Linux. You can also use fuser itself to kill processes running on specific ports by using the -k flag:

fuser -k 8002/tcp

8002/tcp:            18056

If you navigate back to your first terminal window, you will notice that the nc program has been killed and returned to the shell.
The fuser utility can also be used to send specific signals to a process. When used with the -k option, the fuser command sends the KILL signal to a process. There are many other signals that can be sent to a specific running process. You can list these with fuser -l:

fuser -l

HUP INT QUIT ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT
CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH POLL PWR SYS

Conclusion #

In this article, you learned some example uses of fuser to monitor in-use ports and directories on a Linux system. fuser can be particularly useful when you’re trying to understand what unknown processes may be running on your system.
Next, you may want to learn how to use netstat and du to monitor other server resources.