Shell Programming and Scripting

>man lsof

Maintenance Procedures                                    LSOF(8)



NAME
     lsof - list open files

SYNOPSIS
     lsof [ -?abChlnNOPRstUvVX ] [ -A A ] [ -c c ] [  +c  c  ]  [
     +|-d d ] [ +|-D D ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [
     -i [i] ] [ -k k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ] [ -o  [o]
     ]  [  -p  s  ] [ +|-r [t] ] [ -S [t] ] [ -T [t] ] [ -u s ] [
     +|-w ] [ -x [fl] ] [ -z [z] ] [ -- ] [names]

Commands Reference, Volume 2, d - h
fuser Command

Purpose

Identifies processes using a file or file structure.
Syntax

fuser [ -c | -d | -f ] [ -k | -K { SignalNumber | SignalName }] [ -u ] [ -x ] [ -V ]File ...
Description

The fuser command lists the process numbers of local processes that use the local or remote files specified by the File parameter. For block special devices, the command lists the processes that use any file on that device.

Each process number is followed by a letter indicating how the process uses the file:
c 	Uses the file as the current directory.
e 	Uses the file as a program's executable object.
r 	Uses the file as the root directory.
s 	Uses the file as a shared library (or other loadable object).

The process numbers are written to standard output in a line with spaces between process numbers. A new line character is written to standard error after the last output for each file operand. All other output is written to standard error.

The fuser command will not detect processes that have mmap regions where that associated file descriptor has since been closed.
Flags

-c 	Reports on any open files in the file system containing File.
-d 	Implies the use of the -c and -x flags. Reports on any open files which have been unlinked from the file system (deleted from the parent directory). When used in conjunction with the -V flag, it also reports the inode number and size of the deleted file.
-f 	Reports on open instances of File only.
-K SignalNumber | SignalName 	Sends the specified signal to each local process. Only the root user can kill a process of another user. Signal can be specified as either a signal name, such as -9 or KILL for the SIGKILL signal. Valid values for SignalName are those which are displayed by the kill -l command.
-k 	Sends the SIGKILL signal to each local process. Only the root user can kill a process of another user.
Note:
fuser -k or -K might not be able to detect and kill new processes that are created immediately after the program starts to run.
-u 	Provides the login name for local processes in parentheses after the process number.
-V 	Provides verbose output.
-x 	Used in conjunction with -c or -f, reports on executable and loadable objects in addition to the standard fuser output.
Examples

   1. To list the process numbers of local processes using the /etc/passwd file, enter:

      fuser /etc/passwd

   2. To list the process numbers and user login names of processes using the /etc/filesystems file, enter:

      fuser -u /etc/filesystems

   3. To terminate all of the processes using a given file system, enter:

      fuser -k -x -u -c /dev/hd1 

      or

      fuser -kxuc /home

      Either command lists the process number and user name, and then terminates each process that is using the /dev/hd1 (/home) file system. Only the root user can terminate processes that belong to another user. You might want to use this command if you are trying to unmount the /dev/hd1 file system and a process that is accessing the /dev/hd1 file system prevents this.
   4. To list all processes that are using a file which has been deleted from a given file system, enter:

      fuser -d /usr

Files

/dev/kmem 	Used for the system image.
/dev/mem 	Also used for the system image.
Related Information

The kill command, killall command, mount command, and ps command.

For more information about the identification and authentication of users, discretionary access control, the trusted computing base, and auditing, refer to Security.