fuser Command: Finding Processes Using Files and Directories

fuser Command: Finding Processes Using Files and Directories
Reading time: About 10 min Difficulty: Intermediate

What You'll Learn

  • How to find which processes are using a file or directory with fuser
  • How to track down the culprit behind umount "target is busy" / "device is busy" errors
  • How to kill busy processes safely with -k, -i, and explicit signals

Quick Summary

  • Want to know who is holding a file → fuser -v <target>
  • Can't unmount a filesystem → fuser -m <mountpoint> to find the culprit
  • Confirmed it's safe to stop → fuser -ki <target> (interactive kill)

Assumptions

  • Any distribution (fuser ships in the psmisc package)
  • Examples assume Ubuntu / systemd
  • Mount operations and killing may require root depending on the target

What is fuser?

Conclusion: fuser does a reverse lookup — given a file, directory, mount point, or socket, it tells you which processes are currently using it, with PIDs and access types.

ps and top go from "process → what it's doing". fuser goes the other way: "which process is holding this file right now?"

The simplest usage passes the target as an argument.

$ fuser /var/log/syslog
/var/log/syslog:       742

742 is the PID using /var/log/syslog. PIDs are printed to the right of the colon. If nothing is holding it, no PID is shown and the exit code is non-zero.

If fuser is missing, install psmisc (sudo apt install psmisc / sudo dnf install psmisc). The same package provides pstree and killall.

How do I see who is using it in detail? (-v)

Conclusion: Add -v (verbose) to get a table of USER, PID, ACCESS type, and COMMAND, so you can see who is holding the file and how.

A bare PID rarely tells the whole story. -v adds context.

$ fuser -v /var/log/syslog
                     USER        PID ACCESS COMMAND
/var/log/syslog:     syslog      742 F.... rsyslogd

Each letter in the ACCESS column describes how the process holds the target.

Symbol Meaning
c current directory
e executable being run
f open file (omitted in the default display)
F open file for writing (omitted in default display)
r root directory
m mmap'd file or shared library

In the example, F.... means rsyslogd has the file open for writing. Note that in the default (non--v) output, f and F are omitted — only the PID and trailing letters (c, e, r, m) appear.

How do I fix umount "target is busy"?

Conclusion: The unmount fails because some process is using a file on that filesystem. fuser -m <mountpoint> lists every process holding it.

This is the most common scenario.

$ sudo umount /mnt/data
umount: /mnt/data: target is busy.

With -m, fuser lists every process using a file on the given mounted filesystem (the argument may be a mount point or a block device).

$ fuser -vm /mnt/data
                     USER        PID ACCESS COMMAND
/mnt/data:           alice      3210 ..c.. bash
                     alice      3398 F.... vim

Here bash (whose current directory is under /mnt/data) and vim (editing a file) are holding it. Try the clean fix first.

  1. bash → cd out of /mnt/data in that shell
  2. vim → save and quit

Only if a stubborn background process remains, and you have confirmed it is safe to stop, move on to killing it.

If you pass -m a plain directory rather than a mount point, every process on that whole filesystem becomes a target. Combine it with -M (--ismountpoint) so fuser only acts when the argument is an actual mount point, preventing accidents.

How do I stop busy processes safely? (-k / -i)

Conclusion: -k kills the processes using the target, but the default signal is SIGKILL (instant). In practice, pair it with -i (interactive) and an explicit signal.

-k sends a signal to the listed processes. With no signal specified, the default is SIGKILL (-9), terminating processes with no cleanup.

# Dangerous: SIGKILL every process on /mnt/data with no confirmation
$ fuser -km /mnt/data

To avoid accidents, add these two flags.

# -i: ask before killing each process
# -TERM: send SIGTERM (graceful) instead of SIGKILL
$ fuser -kim -TERM /mnt/data
                     USER        PID ACCESS COMMAND
/mnt/data:           alice      3398 F.... vim
Kill process 3398 ? (y/N)

Specify signals by name (-HUP, -TERM, -KILL) or number. List available signals with fuser -l.

How do I find the process using a port? (-n)

Conclusion: fuser -n tcp <port> identifies the process listening on or using a TCP/UDP port — handy for "Address already in use" errors.

-n <space> switches the namespace. Use tcp or udp to search by port number.

# Process using TCP port 80
$ sudo fuser -v -n tcp 80
                     USER        PID ACCESS COMMAND
80/tcp:              root      1180 F.... nginx

The port/protocol form fuser 80/tcp produces the same result. When a server won't start with Address already in use, this pinpoints the culprit.

For investigating ports and sockets in depth, ss and lsof give more detail. fuser shines when you want to identify a holding PID and stop it immediately (with -k). Choose by purpose.

fuser vs lsof: which should I use?

Conclusion: Use fuser to identify a busy PID and kill it on the spot; use lsof to list and investigate open files and ports in detail. They overlap, but their goals differ.

Aspect fuser lsof
Main purpose Identify holding PIDs + kill List/inspect open files and sockets
Output PIDs and access types (concise) Process, FD, type, size, etc. (detailed)
Kill capability Yes (-k) No (kill the PID separately)
Whole mount point -m is built for it +D / +f as alternatives
Package psmisc lsof

To "find and immediately stop whatever blocks an unmount", fuser -m is the shortest path. To "investigate what's happening at leisure", reach for lsof.

Copy-paste: busy-fix template

# 1) Identify the culprit (no kill)
fuser -vm /mnt/data

# 2) Once confirmed safe, stop it interactively with SIGTERM
fuser -kim -TERM /mnt/data

# 3) Unmount again
sudo umount /mnt/data

Next Reading