Question: I want to change something in `/etc/group` - namely, to add some user to some group. But something - I don't know what or who - has created an `/etc/group.lock` file. `fuser /etc/group.lock` gives nothing, but that doesn't tell me much.

How can I tell who's the "culprit"? And whether I can safely delete the lock file and be able to change `/etc/group` again?

Note: I'm using SLES 15 on an x86\_64 machine.

Answer: 
Try 

```
lslocks

```

will show files locked with flock manually or by apps. 

Try using lsof to get the user who locked the file. 

```
lsof /etc/.group.swp 

```

Should show similar too. 

```
~]# lsof /etc/.group.swp
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
vim     27611 root    4u   REG  253,1    12288 6299017 /etc/.group.swp

```

or possibly 

```
vim /etc/group 

```

vim will show (if the file is locked) that it is locked, by who, if the file has been modified etc. 

Output of vim on locked file

```
E325: ATTENTION
Found a swap file by the name "/etc/.group.swp"
          owned by: root   dated: Mon Feb 24 14:49:08 2020
         file name: /etc/group
          modified: no
         user name: root   host name: testfoonameserver101
        process ID: 27611 (still running)
While opening file "/etc/group"
             dated: Fri Feb 21 09:23:49 2020

```
You could be in Luck! There was a bug sometime back about .lock files not unlocking after issuing a useradd, though I recall it being REHL 9 or something of the sort. 

If you read the files they may contain a PID corresponding to the last known actor on the file. Additionally you may be able to add a user and it will complete successfully despite printing the opposite in STDout. You're running a 2017/2018 OS so I can only hope that it does not contain a bug similar to what I described. 

Resource: <https://access.redhat.com/errata/RHBA-2004:472>