What is fuser?
5 fuser examples
Syntax and Options
The fuser command in linux is a useful tool through which we can identify the process(es) which are using a particular file. The file in question could be a normal file, a directory, an executable etc.
Linux 101: kill and killall by Jack Wallen on November 12, 2010 in Linux - Last Update: January 16, 2013 - 4 comments If you've come across an application or a process that just won't die, and you're thinking that you might want to reboot your machine - STOP! Hacking / Cyber Security is a very diverse field, so there is no one guide to become hacker. Paths can be different. There are multiple fields like below. We will Post similar topic for each of below fields in separate post in detailed manner. 1- System Hacking. 2- Web Application Security. 3 – Android Pentesting. 4- iOS Pentesting.
In this example, we will run the fuser command to see which processes are using the current directory.
So we see above that a lot of processes are using the current directory (as its the home directory). The numeric value(s) in the output above output represent the PID of the processes using the directory. The alphabet ‘c’ signifies ‘current directory’. Complete list of alphabets that can be part of fuser output include :
c : current directory
e : executable being run
f : open file. f is omitted in default display mode
F : open file for writing. F is omitted in default display mode
r : root directory
m : mmap’ed file or shared library
If we wish to have a detailed output then ‘-v’ option can be used. We repeat the same example as above but this time with -v option :
Lets consider example of an executable here and see how fuser identifies the processes using an executable. I opted for running fuser on firefox executable which is running on my system :
So the first entry in the output above gives the path to firefox executable running in the system. I’ll use the same path in the following fuser command
So we see that the output is the PID of the process (which can be cross checked against the output of the ‘ps’ command above). The post fix ‘e’ signifies that the file is an executable.
An extra information regrading the user name of the process owner can also be appended to each PID using the -u option.
We can specify multiple files as input to fuser but by default it provides information on the first file it encounters in the input. If we wish to have information on all the files we supplied as input then -a option can be used.
In the example above, I tried two commands. One without -a option and one with -a option and we can see the difference. The command with -a option displayed information on all the files listed as input to fuser.
|Short Option||Long Option||Option Description|
|-a||–all||Show all files specified on the command line. By default, only files that are accessed by at least one process are shown.|
|-c||Same as -m option, used for POSIX compatibility.|
|-f||Silently ignored, used for POSIX compatibility.|
|-k||–kill||Kill processes accessing the file. Unless changed with -SIGNAL, SIGKILL is sent. An fuser process never kills itself, but may kill other fuser processes. The effective user ID of the process executing fuser is set to its real user ID before attempting to kill.|
|-i||–interactive||Ask the user for confirmation before killing a process. This option is silently ignored if -k is not present too|
|-m NAME||–mount NAME||NAME specifies a file on a mounted file system or a block device that is mounted. All processes accessing files on that file system are listed. If a directory file is specified, it is automatically changed to NAME/. to use any file system that might be mounted on that directory.|
|-M||–ismountpoint||Request will be fulfilled only if NAME specifies a mountpoint. This is an invaluable seatbelt which prevents you from killing the machine if NAME happens to not be a filesystem.|
|-v||–verbose||Verbose mode. Processes are shown in a ps-like style. The fields PID, USER and COMMAND are similar to ps. ACCESS shows how the process accesses the file. Verbose mode will also show when a particular file is being access as a mount point, knfs export or swap file. In this case kernel is shown instead of the PID.|
|-SIGNAL||Use the specified signal instead of SIGKILL when killing processes. Signals can be specified either by name (e.g. -HUP) or by number (e.g. -1). This option is silently ignored if the -k option is not used.|