fuser linux

2022-11-29 09:38:54

　　fuser　　identify processes using files or sockets

fuser displays the PIDs of processes using the specified files or file systems. In the default display mode, each file name is followed by a letter denoting the type of access:

c current directory.　　当前目录
e executable being run.　　
f open file. f is omitted in default display mode.
F open file for writing. F is omitted in default display mode.
r root directory.
m mmap'ed file or shared library.

fuser returns a non-zero return code if none of the specified files is accessed or in case of a fatal error. If at least one access
has been found, fuser returns zero.

fuser 在无进程访问指定files or sockets时,为了避免进程错误会返回non-zero结果,以此可作为脚本判断条件

In order to look up processes using TCP and UDP sockets, the corresponding name space has to be selected with the -n option. By
default fuser will look in both IPv6 and IPv4 sockets. To change the default, behavior, use the -4 and -6 options. The socket(s) can
be specified by the local and remote port, and the remote address. All fields are optional, but commas in front of missing fields
must be present:

[lcl_port][,[rmt_host][,[rmt_port]]]

fuser可查询使用sockets的进程,使用namespace的概念

F说明httpd进程对此sockets有写权限

fuser只会把pid输出到stdout,其余信息输出到stderr

上面是lsof显示结果,可作为对比

fuser可用远端ip或端口作为查询条件,但必须遵从特点格式,

[lcl_port][,[rmt_host][,[rmt_port]]]　　　　前面省略的必须以,分隔

192.168.31.109是windows客户端浏览器,可以看到本机与mgt服务器建立了两个sshd会话,其实就是打开两个pts终端

ACCESS中的e表明/usr/bin/passwd是作为可执行程序被运行,我在另一个终端运行了passwd命令

不加-v选项fuser默认不显示系统默认的挂载点,加-v后可看到ACCESS为mount,显示一条ACCESS为/mount的记录其PID为kernel,这是为什么/etc/fstab文件发生挂载错误,会进入emergency模式的原因,因为是在kernel级别产生了错误.

上面为利用rc-local服务挂载的,同样ACCESS为mount,PID为kernel,但是挂载错误,不会导致系统崩溃

Either symbolic or numeric values can be used for IP addresses and port numbers.

fuser outputs only the PIDs to stdout, everything else is sent to stderr.

-k, --kill
Kill processes accessing the file. Unless changed with -SIGNAL, SIGKILL is sent. An fuser process never kills itself, but may
kill other fuser processes. The effective user ID of the process executing fuser is set to its real user ID before attempting
to kill.

结束访问目标文件的进程,默认发送SIGKILL信号,此信号不能被阻塞,处理,忽略,但是当前fuser进程不会杀死自己,可能杀死其他fuser进程