Finding who’s using which file descriptors

Sometimes it is useful to know which processes are using a certain file. You could want to remove the file or move it, or change its name, but it’s not a good idea if it’s being read/written by someone else. Here is when fuser comes in hand.
fuser shows the PID of the processes using a file descriptor passed as argument.

$> fuser $HOME
$> /home/n0str0m0: 1930c 2005c 2023c 2051c 2068c 2083c 2113c
2115c 2117c 2123c 2137c 2138c 2139c 2145c 2230c 2251c 2255c 
2397c 2416c 2419c 2420c 2515c 2520c

The two options I have used the most so far are:

  • -m: tells you processes using a mount point (usefull if you want to release a mount point, but umount tells you the point is in use)
  • -k: kills the processes accessing that file. Risky if you don’t list the processes first ;)

Note: In FreeBSD, fuser is not installed as part of the base system (though you can install it through the ports collection), but you can use lsof instead.

What if we want to do the contrary? We want to know all the files accessed by a process.
In this case, I found the procfs extremely useful. Cd to /proc/<pid>/fd directory and take a look:

$>cd /proc/$(/sbin/pidof firefox)/fd
0:  symbolic link to `/dev/null'
1:  symbolic link to `/dev/tty1'
10: broken symbolic link to `socket:[12276]'
11: broken symbolic link to `socket:[12279]'
12: broken symbolic link to `socket:[12281]'
13: broken symbolic link to `socket:[12284]'
14: symbolic link to `/home/fernape/.mozilla/firefox/02f2dukz.default/.parentlock'
15: broken symbolic link to `pipe:[12340]'
16: broken symbolic link to `pipe:[12340]'
17: broken symbolic link to `socket:[12347]'
18: broken symbolic link to `pipe:[12357]'
19: broken symbolic link to `pipe:[12357]'
2:  symbolic link to `/dev/tty1'

speak up

Add your comment below, or trackback from your own site.

Subscribe to these comments.

Be nice. Keep it clean. Stay on topic. No spam.

You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*Required Fields