lsof and fuser

A filesystem can remain busy because a process has an open file, maps a file into memory, or uses a directory as its current working directory. lsof and fuser help identify those relationships. Inspect first; stopping processes is a separate decision with operational consequences.

Listing Open Files with lsof

lsof means “list open files.” Query a path to see matching open-file records:

$ sudo lsof -- /mnt/usb

For a whole directory tree on the same filesystem, implementations commonly support +D, but recursive scans can be expensive:

$ sudo lsof +D /mnt/usb

Useful columns include COMMAND, PID, USER, file descriptor (FD), type, device, and NAME. A record whose FD is cwd indicates that the process uses the directory as its current working directory. Unprivileged output may be incomplete for processes owned by other users.

CheckWhat does cwd in the FD column indicate?

The process uses that directory as its current working directory. The file was closed while it was being written. The process owns the filesystem device.

Identifying Users with fuser

fuser reports process IDs using a specified file or filesystem. Verbose output adds users, access types, and command names:

$ sudo fuser -v /mnt/usb

To treat the argument as a mounted filesystem and find processes accessing files within it, use the mount option supported by procps fuser:

$ sudo fuser -vm /mnt/usb

Verify that the path is the intended mount point with tools such as findmnt --target /mnt/usb. Bind mounts, namespaces, permissions, and races can affect what a single query reveals.

CheckWhy use fuser -v instead of plain fuser during investigation?

It automatically unmounts the selected filesystem. It adds context such as user, access type, and command. It permanently prevents the processes from reopening files.

Handling a Busy Filesystem

Use a deliberate sequence rather than immediately killing every matching PID:

1. Confirm the host, path, mount source, and intended maintenance.
2. Identify processes with both tools when practical.
3. Determine whether each process can be stopped, moved out of the directory, or allowed to finish.
4. Stop it through its service manager or application interface when available.
5. Query again, then unmount and verify the result.

fuser -k sends a signal to matching processes. Its default signal is SIGKILL on common procps implementations, so it does not provide an orderly shutdown. If an explicitly approved termination is necessary, select an appropriate signal, verify the PID and owner, and understand that the process set can change between inspection and action.

CheckWhy is fuser -k /mnt/usb a poor first troubleshooting step?

It only prints filesystem free space. It can kill multiple matching processes without orderly cleanup. It changes every matching process's working directory.

Choosing the Tool

Use lsof when you need detailed open-file records, descriptors, or socket information. Use fuser for a path-oriented view of matching PIDs and access types. Neither result alone tells you whether a process is safe to terminate.

For network sockets, use an explicit protocol namespace with fuser or a socket-focused tool such as ss:

$ sudo fuser -v 22/tcp
$ sudo ss -lntp

CheckWhich tool is suited to a detailed list of open-file descriptors and owning processes?

lsof uptime free

Summary

You can now investigate file and filesystem use without treating termination as the default response.

1. Use lsof for detailed open-file records.
2. Use fuser for path-oriented PID and access information.
3. Confirm the mount and account for permissions and races.
4. Coordinate an orderly stop before considering a signal.
5. Query again and verify the unmount or service outcome.