In my example, the wc program is trying to open the test FIFO or named pipe. These in-progress open syscalls seem not to be shown by fuser or lsof:

mknod /tmp/testpipe p
wc /tmp/testpipe &
timeout 0.2 strace -p $! |& timeout 0.1 cat; echo
strace: Process 10103 attached
open("/tmp/testpipe", O_RDONLY

fuser /tmp/testpipe  # no output
lsof | grep testpipe  # no output

How to find processes trying to open some FIFO in Linux systems ?

On our A100 machine, we frequently have zombie processes that still allocate memory when already stopped. I usually used fuser -v /dev/nvidia* to determine the PIDs of all processes and kill them either with kill or fuser -k /dev/nvidia*. fuser always took a short while to return the result. But now, the command fuser -v and fuser -k are hanging indefinitely, not responding within any reasonable amount of time. For example, last time, it ran a weekend without returning. I ended up restarting the server. fuser -v /dev/nvidia0 shows the same abnormal behavior, as does lsof /dev/nvidia0. When looking online for this issue, I only get answers to the zombie process problem mentioned above, but no problems specifically for the case when fuser or lsof are hanging. How to debug/solve this problem ideally without restarting the machine? The system runs Ubuntu 20.04.

I am trying to unmount a busy file system on which continuous I/O reads and writes are happening by a multithreaded program due to which the umount command fails.

root@ubuntu:~ # umount /mount/v1
umount: /mount/v1: target is busy.
        (In some cases useful info about processes that use
         the device is found by lsof(8) or fuser(1))

Now, I tried to kill all the processes using /sbin/fuser -m /mount/v1 -k But as per fuser Command > fuser -k or -K might not be able to detect and kill new processes that are created immediately after the program starts to run. which is what happens in my case as some of the threads might have issued IO request when at the same time. When I again go for unmounting the file system, it again says it is busy and this becomes a loop. My question is, how do I ensure that no new processes are able to do read/writes to the filesystem once /sbin/fuser -m /mount/v1 -k command is issued so that the filesystem can be gracefully unmounted.

We are using fuse to find the logs associated to particular port. fuser /test/log* This results in a list of logs associated with port How to find the number of lines on the output? I tried with |wc - l no luck.

I am trying to kill processes with open file handles on a mount point before performing unmount. We observed for a few mount points, the below fuser command is taking a long time. It took more than 3 minutes and still it didn't finish. We haven't opened the mount point in any of our sessions, so the mount point is not busy.

fuser -vcMk mount-point-path

Please provide a resolution or troubleshooting steps for this issue.

cd ~ touch test fuser -v -m test Outputs pretty much all processes on my system, including e.g. chromium. Isn't fuser supposed to be showing only the processes that use the file? I tried it on my Manjaro desktop and on a CentOS server, to the same result of a huge number of processes "using" a freshly created file.

on our rhel machine we saw huge lines as ( total lines numbers are 856 ) that cause very high cpu load average root 110490 108840 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp root 110500 109213 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp root 110507 108848 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp root 110508 108570 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp root 110519 109331 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp root 110552 108776 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp root 110553 109214 0 07:32 ? 00:00:00 /usr/bin/python /var/tmp/get_params/daemon.py --state-docker-json worker-exp . . . . so we can kill all the process by kill as kill 110490 kill 110500 . . . or maybe use with fuser command that can kill all pids that related to /var/tmp/get_params/daemon.py , it can be much more elegant instead to use so many kill commands so how to use fuser or other approach that can kill the pids ,

I have a laptop that refuses to suspend. On the latest Ubuntu, the only way I can turn it off is to hold down the power button. The reason is because I have an nfs share that has gone offline, and something is still trying to commit data to it. I killed everything that was listed in sudo fuser, but it's still busy. Even the poweroff command gets stuck because it can't close the filesystem. How can I find out what is still holding it, and either kill or unmount it, and force a suspend, instead of having to manually, forcibly, shut down?

using the following line I have been able to see processes that use the GPU some of which are mentioned python under the COMMAND column. sudo fuser -v /dev/nvidia* which prints: USER PID ACCESS COMMAND /dev/nvidia0: root 1197 F...m Xorg alireza 1451 F...m gnome-shell alireza 5527 F...m python alireza 5567 F.... python alireza 5568 F.... python how can I kill all the processes which are mentiond python in the COMMAND collumn. But so far i have to do it manually by for each PID by sudo kill -9 which is not easy if there are many of them. is there a way to automate this and make it faster? like writing only one command and kill all the PIDs that has pyton in the COMMAND column?

From local host I'm ssh tunneling some remote host:port to my local host:port, so anybody on a remote host can use their "local" port to access my port via that tunnel. I'm using some regular (non-root) user account on both hosts for this. For example: tunnelingdaemon from my localhost connect tunnelingdaemon@remotehost using ssh -R 127.0.0.1:2222:127.0.0.1:22 remotehost ... and opens port 2222 on remote host and connect it to port 22 on my local host. Root on remote host can use netstat, lsof, or fuser to find the PID of a process which opened and tunneled that port 2222. But regular user (tunnelingdaemon) cannot do that. For example >root: root@remote_host:/# fuser 2222/tcp 2222/tcp: 13709 root@remote_host:/# >tunnelingdaemon: tunnelingdaemon@remote_host:/$ fuser 2222/tcp tunnelingdaemon@remote_host:/$ On a remote host, **I can kill that process as a regular (tunnelingdaemon) user** under which is tunnel opened on the first place, but **I must be root to find which process I should kill**. That's a problem. I need to find a solution for this.

Hellow world! So I've started developing a project that will run on rPi-3B+. I've run into a problem with SSHFS. Right now I'd really like to be able to edit, and commit, the git repo stored on the Pi from my text editor, atom, on my laptop over SSHFS. The first time I mounted the file system it worked fine running this command: sudo sshfs -o allow_other pi@xxx.xx.xx.xxx: ../../mnt/ceresPi2/ Then I started getting this error in terminal: read: Connection reset by peer This thread in this forum from a few years ago was all I found but then I noticed a comment on it from less than a month ago: https://unix.stackexchange.com/questions/94720/connection-reset-by-peer-using-sshfs I've done all the steps suggested by everyone in that thread and am still getting the same result. The second to last comment, by eddygeek, talks about a debug command which gave me the same result as their self: sshfs -odebug,sshfs_debug,loglevel=debug -o Ciphers=arcfour -o Compression=no -o allow_root -o transform_symlinks localhost:/ /mnt/your_mount_point gives command-line line 0: Bad SSH2 cipher spec 'arcfour'. read: Connection reset by peer They claim this doesn't happen in fedora but does in ubuntu without an explanation. I can't seem to find a reason for that online. Would any of you have encountered this recently on Ubuntu or know of a solution? What's stranger is that I have a second pi running different software but I can mount it to '/mnt/ceresPi1/' without a problem. I can mount it to the same '/mnt/ceresPi2/' pount as well. The Pi giving the issues won't mount to the 'ceresPi1' mount point either, nor to a fresh one @'/mnt/ceresPi3'. It doesn't even get to the point of asking me for the user password, as I'm not using the saved keys at the moment, since that's just another failure point while I figure this part out. My stop gap measure is to push a commit to my gitHub repo and then pull it down to the pi server since SSH still works but not SSHFS. obviously this is not ideal. .

I am using in my bash script the following syntax to kill the PID of the script - AmbariAgent.py kill $( ps -ef | grep AmbariAgent.py | grep -v grep | awk '{print $2 }' ) from ps -ef ps -ef | grep AmbariAgent.py | grep -v grep root 63769 1 0 12:39 pts/0 00:00:00 /usr/bin/python /usr/lib/python2.6/site-packages/ambari_agent/AmbariAgent.py start I am just asking if there are more elegant approach instead of the cli - kill $( ps -ef | grep AmbariAgent.py | grep -v grep | awk '{print $2 }' ) ? we try pkill AmbariAgent but PID still up # ps -ef | grep AmbariAgent root 3645 1 0 12:43 pts/0 00:00:00 /usr/bin/python /usr/lib/python2.6/site-packages/ambari_agent/AmbariAgent.py start root 31018 61002 0 13:02 pts/0 00:00:00 grep --color=auto AmbariAgent

This is a hypothetical question, not a problem I currently have. How do you detect which process has used a file now *or in the past*? To find out which process is accessing filename right now, lsof filename or fuser filename will do the work. But what if one wanted to know which processes accessed filename *in the last 24 hours*? One could get away with this ugly (*) hack while true; do fuser filename; sleep 1; done and let it run for 24 hours in another term. But is there actually a better system, without setting up a whole audit framework?

(*) not to mention that fuser could fail to detect the access if it took less than 1 sec...

I'd like to be able to process *multiple* files downloaded by wget -i immediately after they are downloaded (instead of waiting for all files in the list to finish--for the entire wget process to exit). The trouble is: because wget downloads the file in place, I cannot be sure when a file is safe to process (fully downloaded). Ideally, the principled approach is (I believe) to have wget initially download files into a temporary directory and then mv them into the actual destination directory when complete. Because the mv is atomic*, I can guarantee that any file present in the destination directory is completely downloaded and ready for processing. I've been through the manpage, but can't seem to find anything to this end. My current hacky approach is to use fuser to see if wget no longer has the file open. But, this is very fragile (what if wget opens a file multiple times?) and I'd like to avoid it. If there isn't a way to achieve this exactly, is there a workaround that can achieve the same effect? The files are HTML pages if that's at all relevant. *Addendum: Apparently [mv may not be atomic](https://unix.stackexchange.com/a/322074/8506) (although for my env it is), although I don't think strict atomicity is needed. The only requirement is that once a file is renamed into the destination directory it is completely downloaded (and the complete contents are immediately available at the new path). edit: Splitting the process up into multiple wget commands is also not ideal because it precludes using some core features of wget (rate limiting, HTTP keepalive, DNS caching, etc.).

Recently I developed the habit of killing processes with fuser -k -n tcp $PORT which can hardly kill the wrong process. I prefer this over fiddling with a pidfile that may or may not be still there or may or may not contain the correct pid (OK, I am a bit dramatic here :-) Yet the typical stop script I stumble over still uses a pidfile. Am I missing an important feature of the pidfile approach or a misfeature of the fuser approach. My best guess is that fuser is not available. Though judging by search engine results, bsd, debian, suse, centos, aix, solaris all seem to have it.

From ps -ef | grep java, I see many process like this that take a lot of memory. hadoop-+ 65369 65322 0 Jul06 ? 00:01:45 /usr/jdk64/jdk1.8.0_112/bin/java -Xmx8024m -Dhdp.version=2.6.4-091 -Djava.net.preferIPv4Stack=true -Dhdp.version=2.6.4-091 -Dhadoop.log.dir=/var/log/hadoop/hadoop-qa -Dhadoop.log.file=hadoop.log -Dhadoop.home.dir=/usr/hdp/2.6.4-091/hadoop -Dhadoop.id.str=hadoop-qa -Dhadoop.root.logger=INFO,console -Djava.library.path=:/usr/hdp/2.6.4-091/hadoop/lib/native/Linux-amd64-64:/usr/hdp/2.6.4-091/hadoop/lib/native -Dhadoop.policy.file=hadoop-policy.xml -Djava.net.preferIPv4Stack=true -Xmx8024m -Xmx8024m -Djava.util.logging.config.file=/usr/hdp/2.6.4-091/hive/conf/parquet-logging.properties -Dlog4j.configuration=beeline-log4j.properties -Dhadoop.security.logger=INFO,NullAppender org.apache.hadoop.util.RunJar /usr/hdp/2.6.4-091/hive/lib/hive-beeline-1.2.1000.2.6.4-091.jar org.apache.hive.beeline.BeeLine -u jdbc:hive2://master01.sys7643.com:10000/;transportMode=binary -e How to know which script/binary/other is running this processes?

I'm working on a Linux (Scientific Linux CERN SLC release 6.9 (Carbon)) machine on which I am unable to install programs and on which the lsof or fuser commands are not available. I'm trying to remove an NFS dotfile on this machine but I keep getting the Device or resource busy error so I'd like to find out which process (I suspect it might be one I have previously started with nohup) still has a file descriptor to this file. How can I achieve this?

Why when I do: $ kate file.txt & and $ fuser file.txt I've got empty list. After all, kate process opens file.txt

How do I get a list of: * Pathnames currently being watched by inotify, and * PID of the process watching I ask because I have found that [syncthing](https://syncthing.net/) 's inotify watches were preventing my disk from being unmounted. As can be seen below, nothing appears in lsof or fuser listings. I guessed well with syncthing... How do I remove the guesswork in future if a disk won't unmount due to inotify? --------- # umount /media/backup umount: /media/backup: target is busy. # lsof +f -- /media/backup/ # echo $? 1 # fuser -vmM /media/backup/ USER PID ACCESS COMMAND /media/backup: root kernel mount /media/backup # systemctl stop syncthing@ravi # umount /media/backup # echo $? 0

I am goofing around in Metasploitable and trying some commands. Whenever I kill a process using fuser -k 23/tcp to close the port, I get other processes also killed by the process and their ports closed such as vsFTPD process on port 21. Are they linked and is there a way to kill the one without killing the other? Also, there are processes that are being automatically started once I kill them such as the processes that run on ports 3306 mysql or 8180 unknown. Any ideas are highly appreciated.