How to find all the process accessing a file in Linux

There might be a case mostly observed while unmounting, you are unable to unmount a share even though as per your knowledge no one is accessing the share. The possible error which you might get is

Error:
Device busy
Mount Point busy
Text File is busy
In those cases you need to find out all the processes which are still accessing those paths or files which can be done using lsof or fuser command.

Solution:
For example you want to find out all the process which are using /mnt
# fuser -uvm /mnt
                     USER        PID ACCESS COMMAND
/mnt:                root       7899 ..c.. (root)bash
or you can also use
# lsof /mnt
COMMAND  PID USER   FD   TYPE DEVICE SIZE   NODE NAME
bash    7899 root  cwd    DIR   0,18 4096 535032 /mnt (192.168.1.11:/work)





In case you are pretty sure you want to kill all the process using /mnt run the below command
# fuser -km /mnt
/mnt:                 7899c
Re verify
# fuser -uvm /mnt
So now none of the processes are using /mnt and it can be safely unmounted.

Search for deleted processes occupying the filesystem

Again I have seen cases where there are some deleted process which still lock the files unless their parent process or application relating to that process is completely executed. To view those files you might need to use extra parameters like as shown below

# lsof +aL1 /var
COMMAND PID USER FD TYPE DEVICE SIZE NLINK NODE NAME
rhn_check 31261 root 8u REG 253,2 22082560 0 327733 /var/cache/yum/prod-03-epel-x86_64-server-5-rhel5/primary.xml.gz.sqlite (deleted)
rhn_check 31261 root 9u REG 253,2 78848 0 327737 /var/cache/yum/prod-03-likewise-x86_64-client-5-rhel5/primary.xml.gz.sqlite (deleted)
rhn_check 31261 root 10u REG 253,2 144384 0 327741 /var/cache/yum/prod-03-mssb-x86_64-server-5/primary.xml.gz.sqlite (deleted)
rhn_check 31261 root 11u REG 253,2 54056960 0 327748 /var/cache/yum/prod-03-rhel-x86_64-server-5/primary.xml.gz.sqlite (deleted)
rhn_check 31261 root 12u REG 253,2 9275392 0 327752 /var/cache/yum/prod-03-rhel-x86_64-server-supplementary-5/primary.xml.gz.sqlite (deleted)
rhn_check 31261 root 13u REG 253,2 582656 0 327756 /var/cache/yum/prod-03-rhn-tools-rhel-x86_64-server-5-rhel5/primary.xml.gz.sqlite (deleted)

Description

When +L is followed by a number, only files having a link count less than that number will be listed. (No number may follow -L.) A specification of the form +L1 will select open files that have been unlinked. A specification of the form +aL1 <file_system> will select unlinked open files on the specified file system.

I hope I made myself clear.

Related Articles:
How to keep a track of all the commands run by any user in Linux
How do you check Linux machine is Physical or Virtual remotely?
df shows 100% full partition even when there is space on the disk
How to check the lock status of any user account in Linux