Find the Process That is Using a File in Linux

When working with files in Linux, you may encounter situations where you cannot unmount a filesystem or access a file because it shows as "busy". This occurs when a process is actively using the file, keeping it open for reading or writing. To resolve this, you need to identify which process is using the file.

This tutorial covers the essential commands to find processes that are using specific files in Linux systems.

Note Linux commands are case-sensitive.

Commands to Find the Process

Linux provides several commands to identify processes working with files. These commands gather information from the Linux kernel, which manages processes and filesystems.

fuser Command

The fuser command identifies which processes are using a specific file, directory, or socket. It also provides details about the type of access and the user running the process.

Use the -v option for verbose output to see detailed information:

$ fuser -v /path/to/file.txt

Output

                     USER        PID ACCESS COMMAND
/path/to/file.txt:   student   64589 ..c.. less

The ACCESS column shows how the file is being used:

• c Current directory

• r Root directory

• e Executable being run

• f Open file

• m Mapped file or shared library

To kill processes using a file, use the -k flag:

$ fuser -k /path/to/file.txt

Output

/path/to/file.txt: 52349

Verify that the process has been terminated:

$ fuser -v /path/to/file.txt

Output

Cannot stat /path/to/file.txt: No such file or directory

lsof Command

The lsof command stands for "list open files" and is extremely versatile. Since everything in Linux is treated as a file, this tool is invaluable for system administration.

To find processes using files on a specific filesystem or directory:

$ lsof /path/to/directory

Output

COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
systemd   1480   student  cwd   DIR    8,3     4096    2 /path/to/directory
sh        1501   student  cwd   DIR    8,3     4096    2 /path/to/directory

To list files opened by a specific user:

$ lsof -u username

To find processes using a specific file:

$ lsof /path/to/specific/file.txt

Practical Examples

Finding Processes Using a Mount Point

When you cannot unmount a filesystem:

$ lsof +D /mnt/usb
$ fuser -vm /mnt/usb

Finding Network Connections

To see processes using network ports:

$ lsof -i :80
$ fuser -v 80/tcp

Key Differences

Conclusion

Both fuser and lsof are essential tools for identifying processes using files in Linux. Use fuser when you need to quickly identify and potentially kill processes, while lsof provides more detailed information about open files and network connections.