fuser and lsof

Updated 20-Sep-2023

fuser and lsof are two important tools showing which processes are using what files and/or sockets. Fuser is the simpler one focused on finding out what processes are using a given file (or port), while lsof can list processes without specifying, such as all open sockets

Fuser

fuser stands for file user and lists process IDs of all processes that have one or more file open.¹

fuser -k filename

To kill all processes using tcp port 80

fuser -k -n tcp 80

Install on RPM as follows:

yum install -y psmisc

For DEB:

apt-get --yes install fuser

FUSER Usage

Usage: fuser [-fMuvw] [-a|-s] [-4|-6] [-c|-m|-n SPACE] [-k [-i] [-SIGNAL]] NAME...
    fuser -l
    fuser -V
Show which processes use the named files, sockets, or filesystems.
    -a,--all              display unused files too
    -i,--interactive      ask before killing (ignored without -k)
    -k,--kill             kill processes accessing the named file
    -l,--list-signals     list available signal names
    -m,--mount            show all processes using the named filesystems or block device
    -M,--ismountpoint     fulfill request only if NAME is a mount point
    -n,--namespace SPACE  search in this name space (file, udp, or tcp)
    -s,--silent           silent operation
    -SIGNAL               send this signal instead of SIGKILL
    -u,--user             display user IDs
    -v,--verbose          verbose output
    -w,--writeonly        kill only processes with write access
    -V,--version          display version information
    -4,--ipv4             search IPv4 sockets only
    -6,--ipv6             search IPv6 sockets only
    -                     reset options

udp/tcp names: [local_port][,[rmt_host][,[rmt_port]]]

LSOF

lsof stands for list open files. Just as with fuser open files include disk files, named pipes, network sockets, and devices opened by all processes. A way of determining which files are opened by which processes on a given volume is for example:

lsof /var

Install on RPM as follows:

yum install -y lsof

For DEB:

apt-get --yes install lsof

LSOF Usage

A handy usage is the list of tcp or udp processes, for example:

lsof -i udp

Full usage mess

usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]]
[+|-e s] [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M]
[-o [o]] [-p s] [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s]
[+|-w] [-x [fl]] [--] [names]
Defaults in parentheses; comma-separated set (s) items; dash-separated ranges.
    -?|-h             list help
    -a                AND selections (OR)
    -b                avoid kernel blocks
    -c c              cmd c ^c /c/[bix]
    +c w              COMMAND width (9)
    +d s              dir s files
    -d s              select by FD set
    +D D              dir D tree *SLOW?*
    +|-e s            exempt s *RISKY*
    -i                select IPv[46] files
    -K                list tasKs (threads)
    -l                list UID numbers
    -n                no host names
    -N                select NFS files
    -o                list file offset
    -O                no overhead *RISKY*
    -P                no port names
    -R                list paRent PID
    -s                list file size
    -t                terse listing
    -T                disable TCP/TPI info
    -U                select Unix socket
    -v                list version info
    -V                verbose search
    +|-w              Warnings (+)
    -X                skip TCP and UDP* files
    -Z Z              context [Z]
    --                end option scan
    +f|-f             +filesystem or -file names
    +|-f[gG]          flaGs
    -F [f]            select fields; -F? for help
    +|-L [l]          list (+) suppress (-) link counts
    +m [m]            use|create mount supplement
    +|-M              portMap registration (-)
    -o o              o 0t offset digits (8)
    -p s              exclude(^)|select PIDs
    -S [t]            t second stat timeout (15)
    -T qs             TCP/TPI Q,St (s) info
    -g [s]            exclude(^)|select and print process group IDs
    -i i              select by IPv[46] address:
                      [46][proto][@host|addr][:svc_list|port_list]
    +|-r [t[m]]       repeat every t seconds (15);  + until no files, - forever.
                      An optional suffix to t is m; m must separate t from  and
                      is an strftime(3) format for the marker line.
    -s p:s            exclude(^)|select protocol (p = TCP|UDP) states by name(s).
    -u s              exclude(^)|select login|UID set s
    -x [fl]           cross over +d|+D File systems or symbolic Links
    names             select named files or files on named file systems
                      Anyone can list all files; /dev warnings disabled;
                      kernel ID check disabled.

Other Resources

• Nice overview of lsof and fuser at refining-linux