1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
.TH FUSER 1 "Feb 3, 1998" "Linux" "User Commands"
.SH NAME
fuser \- identify processes using files or sockets
.SH SYNOPSIS
.ad l
.B fuser
.RB [ \-a | \-s ]
.RB [ \-n\ \fIspace ]
.RB [ \-\fIsignal\fB ]
.RB [ \-kmuv ]
.I name ...
.RB [ \- ]
.RB [ \-n\ \fIspace ]
.RB [ \-\fIsignal\fB ]
.RB [ \-kmuv ]
.I name ...
.br
.B fuser
.RB \-l
.br
.B fuser
.RB \-V
.ad b
.SH DESCRIPTION
.B fuser
displays the PIDs of processes using the specified files or file systems.
In the default display mode, each file name is followed by a letter denoting
the type of access:
.RS
.IP \fBc\fP
current directory.
.IP \fBe\fP
executable being run.
.IP \fBf\fP
open file. \fBf\fP is omitted in default display mode.
.IP \fBr\fP
root directory.
.IP \fBm\fP
mmap'ed file or shared library.
.RE
.LP
\fBfuser\fP returns a non-zero return code if none of the specified files
is accessed or in case of a fatal error. If at least one access has been
found, \fBfuser\fP returns zero.
.PP
In order to look up processes using TCP and UDP sockets, the corresponding
name space has to be selected with the \fB-n\fP option. Then the socket(s) can
be specified by the local and remote port, and the remote address. All fields
are optional, but commas in front of missing fields must be present:
.RB \fB[\fP\fIlcl_port\fP\fB][\fP,\fB[\fP\fIrmt_host\fP\fB][\fP,\fB[\fIrmt_port\fP\fB]]]
Either symbolic or numeric values can be used for IP addresses and port
numbers.
.SH OPTIONS
.IP \fB\-a\fP
Show all files specified on the command line. By default, only files that are
accessed by at least one process are shown.
.IP \fB\-k\fP
Kill processes accessing the file. Unless changed with \fB-\fP\fIsignal\fP,
SIGKILL is sent. An \fBfuser\fP process never kills itself, but may kill
other \fBfuser\fP processes. The effective user ID of the process executing
\fBfuser\fP is set to its real user ID before attempting to kill.
.IP \fB\-l\fP
List all known signal names.
.IP \fB\-m\fP
\fIname\fP specifies a file on a mounted file system or a block device that
is mounted. All processes accessing files on that file system are listed.
If a directory file is specified, it is automatically changed to
\fIname\fP/. to use any file system that might be mounted on that
directory.
.IP \fB\-n\ \fIspace\fP
Select a different name space. The name spaces \fBfile\fP (file names, the
default), \fBudp\fP (local UDP ports), and \fBtcp\fP (local TCP ports) are
supported. For ports, either the port number or the symbolic name can be
specified. If there is no ambiguity, the shortcut notation
\fIname\fB/\fIspace\fP (e.g. \fIname\fB/\fIproto\fP) can be used.
.IP \fB\-s\fP
Silent operation. \fB\-a\fP, \fB\-u\fP and \fB\-v\fP are ignored in this mode.
.IP \fB\-\fIsignal\fP
Use the specified signal instead of SIGKILL when killing processes. Signals
can be specified either by name (e.g. \fB\-HUP\fP) or by number
(e.g. \fB\-1\fP).
.IP \fB\-u\fP
Append the user name of the process owner to each PID.
.IP \fB\-v\fP
Verbose mode. Processes are shown in a \fBps\fP-like style. The fields PID,
USER and COMMAND are similar to \fBps\fP. ACCESS shows how the process
accesses the file. If the access is by the kernel (e.g. in the case of a
mount point, a swap file, etc.), \fBkernel\fP is shown instead of the PID.
.IP \fB\-V\fP
Display version information.
.IP \fB\-\fP
Reset all options and set the signal back to SIGKILL.
.SH FILES
.nf
/proc location of the proc file system
.fi
.SH EXAMPLES
\fBfuser -km /home\fP kills all processes accessing the file system /home
in any way.
.LP
\fBif fuser -s /dev/ttyS1; then :; else \fIsomething\fP; fi\fR invokes
\fIsomething\fP if no other process is using /dev/ttyS1.
.LP
\fBfuser telnet/tcp\fP shows all processes at the (local) TELNET port.
.SH RESTRICTIONS
Processes accessing the same file or file system several times in the same way
are only shown once.
.PP
If the same object is specified several times on the command line, some of
those entries may be ignored.
.PP
\fBfuser\fP may only be able to gather partial information unless run with
privileges. As a consequence, files opened by processes belonging to other
users may not be listed and executables may be classified as mapped only.
.PP
Installing \fBfuser\fP SUID root will avoid problems associated with
partial information, but may be undesirable for security and privacy
reasons.
.PP
\fBudp\fP and \fBtcp\fP name spaces, and UNIX domain sockets can't be
searched with kernels older than 1.3.78.
.PP
\fBudp\fP and \fBtcp\fP currently only work for IPv4.
.PP
Accesses by the kernel are only shown with the \fB-v\fP option.
.PP
The \fB-k\fP option only works on processes. If the user is the kernel,
\fBfuser\fP will print an advice, but take no action beyond that.
.SH AUTHOR
Werner Almesberger <werner.almesberger@lrc.di.epfl.ch>
.SH "SEE ALSO"
kill(1), killall(1), ps(1), kill(2)
.\"{{{}}}
|
