Process Utilization · Lesson 2

lsof and fuser

Learn how to identify processes using files, directories, mount points, and network sockets.

A filesystem can remain busy because a process has an open file, maps a file into memory, or uses a directory as its current working directory. lsof and fuser help identify those relationships. Inspect first; stopping processes is a separate decision with operational consequences.

Listing Open Files with lsof

lsof means “list open files.” Query a path to see matching open-file records:

$ sudo lsof -- /mnt/usb

For a whole directory tree on the same filesystem, implementations commonly support +D, but recursive scans can be expensive:

$ sudo lsof +D /mnt/usb

Useful columns include COMMAND, PID, USER, file descriptor (FD), type, device, and NAME. A record whose FD is cwd indicates that the process uses the directory as its current working directory. Unprivileged output may be incomplete for processes owned by other users.

What does cwd in the FD column indicate?

Identifying Users with fuser

fuser reports process IDs using a specified file or filesystem. Verbose output adds users, access types, and command names:

$ sudo fuser -v /mnt/usb

To treat the argument as a mounted filesystem and find processes accessing files within it, use the mount option supported by procps fuser:

$ sudo fuser -vm /mnt/usb

Verify that the path is the intended mount point with tools such as findmnt --target /mnt/usb. Bind mounts, namespaces, permissions, and races can affect what a single query reveals.

Why use fuser -v instead of plain fuser during investigation?

Handling a Busy Filesystem

Use a deliberate sequence rather than immediately killing every matching PID:

Confirm the host, path, mount source, and intended maintenance.
Identify processes with both tools when practical.
Determine whether each process can be stopped, moved out of the directory, or allowed to finish.
Stop it through its service manager or application interface when available.
Query again, then unmount and verify the result.

fuser -k sends a signal to matching processes. Its default signal is SIGKILL on common procps implementations, so it does not provide an orderly shutdown. If an explicitly approved termination is necessary, select an appropriate signal, verify the PID and owner, and understand that the process set can change between inspection and action.

Why is fuser -k /mnt/usb a poor first troubleshooting step?

Choosing the Tool

Use lsof when you need detailed open-file records, descriptors, or socket information. Use fuser for a path-oriented view of matching PIDs and access types. Neither result alone tells you whether a process is safe to terminate.

For network sockets, use an explicit protocol namespace with fuser or a socket-focused tool such as ss:

$ sudo fuser -v 22/tcp
$ sudo ss -lntp

Which tool is suited to a detailed list of open-file descriptors and owning processes?

Lesson complete

You finished lsof and fuser

You can now investigate file and filesystem use without treating termination as the default response.

Use lsof for detailed open-file records.
Use fuser for path-oriented PID and access information.
Confirm the mount and account for permissions and races.
Coordinate an orderly stop before considering a signal.
Query again and verify the unmount or service outcome.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Next Lesson

Back to Process Utilization