Fuser and Lsof

FUSER

Fuser function
Fuser can show which program is currently using a file on the disk, mount point, or even network port, and give the program process details.
Fuser Displays the process ID using the specified file or file system. By default, each file name is followed by a letter that represents the access type.
The type of access is as follows:
C represents the current directory
E Use this file as the executable object of the program
F Open the file. Not displayed by default.
F Open file for write operation. Not displayed by default.
R root directory.
m mapping files or shared libraries.

s use this file as a shared library (or other loadable object)
Fuser returns nonzero when the specified file is not accessed, or when an error occurs.
In order to view processes that use TCP and UDP sockets, the-n option is required and the namespace is specified. Both the default IpV4 and IpV6 are displayed. Sockets can be local or remote ports, and remote addresses. All domains are optional, but the preceding ', ' must exist. As follows:
[Lcl_port] [, [Rmt_host][,[rmt_port]]
For both the IP address and port, the name and number representation can be used.
The fuser only outputs the PID to the standard output, and the other outputs to the standard error output.
Common Options
-a displays all the files specified on the command line, and the files that are accessed by default are displayed.
-C and-M are used for POSIX compatibility.
-K kills the process that accesses the file. If no-signal is specified, the Sigkill signal is sent.
-I asks the user before killing the process, which is ignored if there is no-k option.
-l lists all known signal names.
-m name specifies a file mounted on a file system or mounted block device (name). All processes that access this file or file system will be listed. If a directory is specified, it is automatically converted to "name/" and uses all file systems mounted under that directory.
-N space specifies a different namespace (space). Different spatial files (file name, default here), TCP (local TCP port), UDP (local UDP port) are supported here. For ports, you can specify the port number or name, and if not ambiguous, you can use the form of a simple representation, such as: Name/space (i.e., a representation of a shape such as a 80/tcp).
-s silent mode, this time-u,-v will be ignored. -A cannot be used with-S.
-signal uses the specified signal instead of Sigkill to kill the process. Signals (such as-hup,-1) can be represented by name or number, which is used with-K, otherwise it is ignored.
-U adds the user name of the process owner after each PID.
-v Verbose mode. Outputs the output of the PS-like command, including many domains such as Pid,user,command, and if the kernel is accessed then the PID is kernel. -V Output version number.
4 Use IPV4 sockets, cannot and-61 applications, only in the case of the-n TCP and UDP name existence is not ignored.
6 use IPV6 sockets, cannot and-41 applications, only in the case of the-n TCP and UDP name existence is not ignored.
-Reset all the options to set the signal to Sigkill.

Using the example

Show process information for using a file
$ fuser-um/dev/sda2
/dev/sda2:6378c (Quietheart) 6534c (Quietheart) 6628 (Quietheart)
6653C (Quietheart) 7429c (Quietheart) 7549c (Quietheart) 7608c (Quietheart)
This command is useful in umount, and can be used to find out what else is available for this device.
Kill the program that opened the Readme file

$fuser-M-k-i Readme
Here, you will be asked if you are sure before kill. It is best to add-V to know that the process will be killed.
View 80 ports for those programs that use TCP
$fuser-V-N TCP 80
Or

$fuser-V 80/tcp
Application of different signals of fuser
Use the-l parameter to list fuser known signals
# fuser-l
HUP INT QUIT ILL TRAP ABRT IOT BUS FPE KILL USR1 SEGV USR2 PIPE alrm term
Stkflt chld CONT STOP tstp ttin ttou URG xcpu xfsz vtalrm PROF WINCH IO PWR SYS
UNUSED
Fuser can send it a known signal to the specified file process to access instead of the-K parameter sent by default Sigkill, for example: Just suspend the process, then send the HUP signal is ready
# fuser-v/root/install.log
User Process number permission command
/root/install.log:root 3347 f .... tail
# fuser-k-sighup/root/install.log
/root/install.log:3347
# fuser-v/root/install.log

One, why use Fuser?
first say the role of Fuser,
Fuser can identify a process that is being accessed on a file or port
Let's think about it, which command has this function?
Yes, it's lsof.
as we have said before, Lsof is able to identify the process that is being accessed on the specified file .
So what's the difference between them?
Fuser has a special use in that it can kill the process that is accessing the specified file at once
   

two, how to use Fuser?
 
1, how can I use Fuser to get the process that is using the specified file?
usage: Fuser file
Description: It will list the process ID that is using the current file

[email protected] lhd]# Umount/
umount:/: Device is busy.
(in some cases useful info about processes
The device is found by lsof (8) or fuser (1))
[email protected] lhd]# Fuser/
/: 1RC 2rc 3rc 4rc 5rc 6rc 7rc 80rc 82rc 84rc 85rc 153rc 157RC 158RC
160RC 165rc 168rc 203rc 204rc 205rc 253rc 441rc 444rc 516rc 521rc 524rc 582r C 583RC
584rc 633rc 1052rc 1392rc 1394rc 1417rc 1597rc 1609rc 1617rc 1620rc 1683rc 1744RC 1783R 1785RC
1788rc 1806r 1808r 1810rc 1811rc 1812rc 1813rc 1814rc 1815rc 1848rc 1886rc 1899RC 1900RC 2001RC
                              ...... Too many not listed

Description:
what does the RC behind these process numbers mean?
     
c Use this file as the current directory.
e Use this file as an executable object for your program.
r Use this file as the root directory.
s Use this file as a shared library (or other loadable object)

2, how to list the process details, not just the process ID?
You can use the-v parameter
Description:-V: The meaning is: Verbose output, verbose export information
Example:

[email protected] ~]# Fuser/var/log
/var/log:4196c
[email protected] ~]# fuser-v/var/log
     
USER PID ACCESS COMMAND
/var/log:root 4196.. C.. bash

3, how do I list the users that the process belongs to?
You can use the-u parameter
Description:-u: Meaning: Display user IDs
    
Example:
[email protected] ~]# fuser-u/var/log
/var/log:4196c (Root)
Description:-N: Meaning: Get the process number that is accessing a port, and then kill it with the kill command.

[email protected] ~]# Fuser-un TCP
25/tcp:4196 (Root)
4, how do I kill all the processes that are accessing the specified file?
You can use the-K parameter
Description:-K: Meaning: Kill processes accessing the named file

Example:

[email protected] lhd]# fuser-v/root/install.log
User Process number permission command
/root/install.log:root 3185 f .... Tail
[email protected] lhd]# fuser-k/root/install.log
/root/install.log:3185
[email protected] lhd]# fuser-v/root/install.log

Description: The-K parameter is capable of killing all processes that are accessing the specified file, so it is very convenient to kill the process
description of the second: Fuser How to kill the process?
it sends this signal: SIGKILL



three, learn a little more knowledge

The 1,fuser can list the signals it knows:
You can use the-l parameter
    
Example:
[email protected] ~]# fuser-l
HUP INT QUIT ILL TRAP ABRT IOT BUS FPE KILL USR1 SEGV USR2 pipealrm term
stkflt chld CONT STOP tstp ttin ttou URG xcpu xfsz vtalrm profwinch IO PWR SYS
UNUSED

2,fuser can send it a known signal to the specified file process to access instead of the-K parameter sent by default Sigkill
For example: Just suspend the process, then send the HUP signal can be
    
Example:
[email protected] lhd]# fuser-v/root/install.log
User Process number permission command
/root/install.log:root 3347 f .... Tail
[email protected] lhd]# fuser-k-sighup/root/install.log
/root/install.log:3347
[email protected] lhd]# fuser-v/root/install.log

LSOF

Lsof has more features
# lsof-i See what Open ports are in the system, which processes, users are using them, and more verbose than the NETSTAT-LPTU output.

# lsof-i 4 View IPv4 type of process
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
EXIM4 2213 Debian-exim 4u IPv4 4844 TCP *:smtp (LISTEN)
Dhclient3 2306 Root 4u IPv4 4555 UDP *:BOOTPC

# lsof-i 6 View IPv6 type of process
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
EXIM4 2213 debian-exim 3u IPv6 4820 TCP *:smtp (LISTEN)

# lsof-i @192.168.1.2 View processes associated with a specific IP
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Amule 3620 root 16u IPv4 11925 TCP 192.168.1.2:42556->77.247.178.244:4242 (established)
Amule 3620 root 28u IPv4 11952 TCP 192.168.1.2:49915->118-166-47-24.dynamic.hinet.net:5140 (established)

# lsof-p 5670 View the files opened by the PID 5670 process.

Fuser and Lsof