Find the Process That is Using a File in Linux

Abstract

There may be a situation where, despite the fact that no one is attempting to access the share to your knowledge, you are unable to unmount it. This is typically seen while mounting a share. The potential error that you could experience is "the file is busy", or we may occasionally see the notice "the file is busy" when attempting to access a file. This indicates that a process is active on the system that is using the file and keeping it open for reading or writing. Sometimes, when this occurs, we'll want to figure out which process is using the file.

The process that uses a file will be identified in this tutorial.

Note − Linux commands are case-sensitive.

Commands to find the process

There are a few commands that can assist us in locating processes that work with files, so we'll start there. These commands collect information from the Linux kernel since it manages programs and file systems, among other things.

fuser command

A Linux command called fuser can be used to determine which process is using a specific file, directory, or socket. Additionally, it offers details on the sort of access and the user who is in charge of operating that process.

fuser can also be used in verbose mode by using the -v option. To generate additional output so the user can see what fuser is doing, use the verbose option. Run fuser with the -v option,

$ fuser -v scripts.txt 

Output

                          USER          PID ACCESS COMMAND
/run/sripts.txt:          student       64589 ..c.. less

The -k flag in the fuser command can also be used to stop or kill processes from running on particular ports.

$ fuser -k scripts.txt 

Output

/run/sripts.txt:       52349   

To reverify whether the process has been killed or not, we will again lookout for the “scripts.txt” file,

$ fuser -v scripts.txt   

Output

none of the processes are using scripts.txt 

Again, I've encountered instances, where some deleted processes continue to lock files until their parent process or an application connected to that process, has finished running. You might need to use extra options, such as those in the example below, to view certain files.

lsof command

The lsof command stands for "list open files," but it can serve other purposes as well. It's a frequent misconception that everything in Linux is a file. That's true in many ways, therefore a tool that identifies open files is actually rather helpful.

To find out who is utilising any files on a file system, use the lsof command. Running the lsof command on a Linux filesystem will produce the following result, which shows the owner and process details for any processes utilising the file.

$ lsof /dev/run/files

Output

COMMAND   PID      USER     FD    TYPE   DEVICE   SIZE/OFF    NODE NAME
systemd   1480    student    0r    CHR    1,3      0t0       6 /dev/run/files
sh        1501    student    0r    CHR    1,3      0t0       6 /dev/run/files
sh        1501    student    1w    CHR    1,3      0t0       6 /dev/run/files
dbus-daem 1530    student    0u    CHR    1,3      0t0       6 /dev/run/files
Xfce4-seb 1603    student    0r    CHR    1,3      0t0       6 /dev/run/files
xfce4-ses 1603    student    1w    CHR    1,3      0t0       6 /dev/run/files
at-spi-b  1604    student    0r    CHR    1,3      0t        6 /dev/run/files
dbus-daem 1609    student    0u    CHR    1,3      0t0       6 /dev/run/files

Run the following command, to list user-specific opened files

$ lsof -u student

Output

COMMAND    PID      USER       FD     TYPE          DEVICE   SIZE/OFF       NODE NAME
systemd    1480    student   cwd       DIR           8,3      4096              2 /
systemd    1480    student   rtd       DIR           8,3      4096              2 /
systemd    1480    student   txt       REG           8,3      1595792        3147496 

Conclusion

In this tutorial, we learned some examples of how to monitor in-use ports and directories on a Linux system using the fuser and lsof commands. These commands can be especially helpful if you're attempting to identify any unknown programs that might be active on your system. I hope you find these examples of the commands useful.