What it does
fuser shows which processes are accessing a file, directory, or network socket. It can also send signals to those processes, making it useful for resolving “device busy” and “address already in use” errors.
How it works (mechanical)
fuser scans kernel tables (via /proc) to find processes
that have file descriptors pointing to the specified resource. For network
sockets, it maps ports to owning PIDs.
- Inspects open file descriptors in
/proc - Maps TCP/UDP ports to processes
- Can operate on files, directories, block devices, and sockets
- Optionally sends signals to matched PIDs
10 Practical Examples
# 1) Find processes using a file fuser /var/log/syslog
# 2) Find processes using a directory fuser /mnt/data
# 3) Identify process using a TCP port sudo fuser -n tcp 8080
# 4) Identify process using a UDP port sudo fuser -n udp 53
# 5) Verbose output with usernames sudo fuser -v /var/log/syslog
# 6) Kill processes using a file (TERM) sudo fuser -k /mnt/data
# 7) Force kill (SIGKILL) processes on a port sudo fuser -k -9 -n tcp 8080
# 8) Check who is using a block device sudo fuser -v /dev/sdb1
# 9) Combine with umount when busy sudo umount /mnt/data || sudo fuser -k /mnt/data
# 10) Show PIDs only (script-friendly) fuser -a /var/log/syslog
Notes & Gotchas
- Root privileges are often required for full visibility.
fuser -kcan terminate critical services — use carefully.- Directories report processes with cwd or open files inside.
- For complex cases,
lsofprovides more detail. - Network lookups use port numbers, not service names.
Historical Context
fuser originated in System V UNIX and became a standard
troubleshooting tool for identifying resource contention.
Linux implementations integrate tightly with /proc.
Modern Equivalent / Related Tools
- lsof — detailed open file and socket listings
- ss — socket-level inspection
- ps — process listings
- kill / pkill — signal delivery
- systemctl — service-level control