[ale] Fuser questions

[Brian Pitts]

On 01/04/2011 02:56 PM, James Sumners wrote:
> I think that might be your distributions version of fuser. The one
> packaged with Debian Lenny isn't showing this behavior for me[1].
> 
> [1] -- http://dl.dropbox.com/u/1038672/lsof-fuser.png

Thanks for looking into this with me. After testing on some more distros
I agree that the behavior has changed in newer fuser version. The
confusion that prompted my email was the behavior on RHEL4 (ugh).

> On Tue, Jan 4, 2011 at 10:51 AM, Brian Pitts <brian at polibyte.com> wrote:
>> I have two questions about the fuser command.
>>
>> Can anyone explain why fuser identifies the process as running as root
>> but ps says it is running as pbr?
>>
>> $ sudo /sbin/fuser -vn tcp 6013
>> here: 6013
>>
>>                     USER        PID ACCESS COMMAND
>> 6013/tcp             root      24376 f....  sshd
>>
>> $ ps -p 24376 -o '%U'
>> USER
>> pbr

The "here" thing and misidentification of the user only seems to occur
in the version of fuser in RHEL4. It's fixed in RHEL5 and Fedora 14.

>> Can anyone explain what fuser means by "here" and why it does not list
>> the two processes that lsof does?
>>
>> $ /sbin/fuser -vn tcp 51422
>> here: 51422
>>
>> $ sudo /usr/sbin/lsof -i TCP:51422
>> COMMAND   PID USER   FD   TYPE    DEVICE SIZE NODE NAME
>> sshd    24372 root    3u  IPv4 103565535       TCP foo:ssh->bar:51422
>> (ESTABLISHED)
>> sshd    24376  pbr    3u  IPv4 103565535       TCP foo:ssh->bar:51422
>> (ESTABLISHED)

It turns out that in recent fuser the syntax is
localport,remotehoste,remoteport.

$ /sbin/fuser -vn tcp ,,51422

would have returned what I was looking for. The fuser in RHEL5 isn't new
enough for this, but the one in Fedora 14 is.

-- 
All the best,
Brian Pitts