How do I find out who is using a particular file?

[pap]

Is there any way that I can find out who is currently using a particular file???

I know fuser can tell us about file system but I want to find out about the FILE.

thanks,
-pap

[Jeff Schussele · Accepted solution]

Hi Piyush,

fuser CAN go all the way down to file. Just give it the full path.

HTH,
Jeff

[Patrick Wallek]

fuser can tell about a file as well.

# fuser -u /mount/point/filename

You can also download and use lsof. It is available from:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.61/

[harry d brown jr]

get lsof

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.61/


live free or die
harry

[Kelli Ward]

I haven't tried this, but it also might work.
ps -ef | grep
note the PID # and all the PPID # for it until you find the shell.
who -u
Look for any of the numbers noted and see which user has them.

I know, it's long and ugly, but I'm in a strange mood today and for some reason, it popped into my head.

Must be the only 4 hours sleep I got last night.

Good luck you ya,
Kel

[Mark Fenton]

Kel's suggestion probably wouldn't work for database files -- probably'd work for straight file edits (e.g. someone has vi'd a file...)

Stick with either lsof (if installed) or fuser

fuser -u /path/to/file gives the username along with the process id that is touching the file.

lsof |grep /path/to/file/name will also spit out a list of usernames that are touching a file, and a wealth of other information that could be of possible interest.

hth
Mark

[Kelli Ward]

Howdy,
Admittedly, even if my suggestion did work, I wouldn't be suprised if you had to chase PPIDs making it a real pain to use.
But, for some reason, it popped in my head.
The worse part is, I had a triple shot of espresso yesterday and it still didn't help! ;)
Oh well, I feel much better today.
Kel

[pap]

Hi kelly..

It is a great thing that you were wrked so hard for the day and took time to respond my question.
Appreciated your effort.

-pap

[Jeff Schussele]

Harry,

You'll get absolutely no argument from me on the utility & IMPORTANCE of lsof.
NO HP shop should be w/o it!
We were just pointing out to Piyush that fuser -u can go down to the file level as most people (I included until a while ago) thought fuser only operated at the FS level.

Looking for a way to live TAX free,
Jeff

....exspecially this time of year......

[Darrell Allen]

Hi all,

I absolutely agree that lsof is far more functional than fuser HOWEVER...

I've worked at a site where lsof wasn't approved by security. It is rather powerful though I personally feel it should be in every sysadmin's bag of tricks.

I also believe in using OS tools if they will do what's needed.

For the above reasons, I'd choose "fuser -c" (gotta use "-c") to tell if a filesystem is in use. I'd simply use "fuser filename" on a file.

Testing "fuser -c" vs lsof I did the following to see how many processes were using /var on an idle system:

# lsof /var | awk '{print $2}' | grep -v PID | sort -u | wc -l
40
#for i in $(fuser -c /var 2>&1)
do
echo $i | tr -d [a-z]
done | grep -v /var: | wc -l
40

Note both of the above return 40 pids. lsof's output is much more informative but not really neccessary to know if a file or a filesystem is in use.

Darrell