122

I tried to remove a file in Linux using rm -rf file_name, but got the error:

rm: file_name not removed.  Text file busy

How can I find out which process is using this file?

lhf
  • 70,581
  • 9
  • 108
  • 149
khris
  • 4,809
  • 21
  • 64
  • 94

4 Answers4

170

You can use the fuser command, which is part of the psmisc package, like:

fuser file_name

You will receive a list of processes using the file.

You can use different flags with it, in order to receive a more detailed output.

You can find more info in the fuser's Wikipedia article, or in the man pages.

Emil Engler
  • 489
  • 5
  • 14
jimm-cl
  • 5,124
  • 2
  • 25
  • 27
  • I tried this: fuser -i /home/bin/lib. But got this: fuser: illegal option -- i /home/bin/lib: 27674t – khris Jul 03 '14 at 13:38
  • 1
    @khris, might be that not all `fuser` implementations are the same, or works the same way. Even if `-i` is defined in POSIX, the particular implementation you are using does not necessarily has the same options as the ones described in the Wikipedia article. For example, I'm using AIX right now, and the `fuser` available in this system does not have the `-i` option either. – jimm-cl Jul 03 '14 at 13:41
  • For some reason, neither `fuser` nor `lsof` were working for me on a virtualbox guest. [This answer](https://stackoverflow.com/a/25478470/2065427) saved me. – kael Jan 28 '18 at 06:28
  • I had to run it like `fuser -v file_name` for it to show the processes. – yohosuff Oct 07 '22 at 17:39
  • depending on the user that is using the file, use with sudo: sudo fuser file_name – i000174 Oct 19 '22 at 14:56
45

@jim's answer is correct -- fuser is what you want.

Additionally (or alternately), you can use lsof to get more information including the username, in case you need permission (without having to run an additional command) to kill the process. (THough of course, if killing the process is what you want, fuser can do that with its -k option. You can have fuser use other signals with the -s option -- check the man page for details.)

For example, with a tail -F /etc/passwd running in one window:

ghoti@pc:~$ lsof | grep passwd
tail      12470    ghoti    3r      REG  251,0     2037 51515911 /etc/passwd

Note that you can also use lsof to find out what processes are using particular sockets. An excellent tool to have in your arsenal.

ghoti
  • 45,319
  • 8
  • 65
  • 104
9

For users without fuser :

Although we can use lsof, there is another way i.e., we can query the /proc filesystem itself which lists all open files by all process.

ls -l /proc/*/fd/* | grep filename

Sample output below:

l-wx------. 1 root root  64 Aug 15 02:56 /proc/5026/fd/4 -> /var/log/filename.log

From the output, one can use the process id in utility like ps to find program name

Christian Fritz
  • 20,641
  • 3
  • 42
  • 71
Manickaraj
  • 91
  • 1
  • 2
-5
$ lsof | tree MyFold

As shown in the image attached:

enter image description here

Dolly
  • 2,213
  • 16
  • 38
Madinabonu Alisherova
  • 37
  • 5
  • 4
    How does this work? Does `tree` read anything from stdin? If yes, what does it do with that input? – dyp Oct 14 '20 at 15:36
  • man lsof – displays manual for command lsof, lsof – list open files, lists on its standard output file information about files opened by processes and result can seen in a tree structure. you should check what is lsof clearly – Madinabonu Alisherova Oct 16 '20 at 19:17
  • 6
    My question is about `tree`, not `lsof`. As far as I understand, `tree` doesn't read from standard input, therefore the output of `lsof` is _discarded_ when you run `lsof | tree ...`. If that's correct, then `lsof | tree MyFold` is the same as `tree MyFold`, which just displays the contents but not which files are opened by some process. – dyp Oct 19 '20 at 08:22
  • 1
    Using a screenshot of text that could have been posted as text in the first place does not add validity to the answer. – WinEunuuchs2Unix Aug 12 '23 at 02:17