mjhjmtu

root@host [/home2]# lsof /home2
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
php 3182 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3182 ctxmortg 3r REG 8,17 46404 55781766 /home2/ctxmortg/public_html/hello/cache/subprimemortgagemorgage.com/cache-zch-8284-cache.txt
php 3185 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3185 ctxmortg 3r REG 8,17 4185 35962154 /home2/ctxmortg/public_html/hello/cache/curl/http%3A%2F%2Fimage.yahoo.cn%2Fs%3Fq%3DNudity%26c%3D0%26s%3D%26page%3D277
php 3187 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3187 ctxmortg 3r REG 8,17 54640 69699731 /home2/ctxmortg/public_html/hello/cache/newdatingfriends.com/cache-zch-1545-cache.txt
php 3188 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3188 ctxmortg 3r REG 8,17 54640 21557063 /home2/ctxmortg/public_html/hello/cache/customersdeals.com/cache-zch-5715-cache.txt
php 3189 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3189 ctxmortg 3r REG 8,17 4185 36028071 /home2/ctxmortg/public_html/hello/cache/curl/http%3A%2F%2Fimage.yahoo.cn%2Fs%3Fq%3DVideos%26c%3D0%26s%3D%26page%3D329
php 3200 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3200 ctxmortg 3r REG 8,17 21036 9155614 /home2/ctxmortg/public_html/hello/cache/indorealestates.com/cache-zch-8562-cache.txt
lsof 3201 root cwd DIR 8,17 4096 2 /home2
lsof 3202 root cwd DIR 8,17 4096 2 /home2
webalizer 32342 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32360 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32360 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32361 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32361 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32362 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32362 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32363 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32363 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32364 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32364 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32365 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32365 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32366 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32366 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32367 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32367 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32368 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32368 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32369 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32369 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
bash 32409 root cwd DIR 8,17 4096 2 /home2

I want to umount a drive but cannot.

So, what does cwd, 3r dir, and reg mean anyway?

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db

FD - File Descriptor

If you are looking for file being written, look for following flag

# - The number in front of flag(s) is the file descriptor number of used by the process to associated with the file
u - File open with Read and Write permission
r - File open with Read permission
w - File open with Write permission
W - File open with Write permission and with Write Lock on entire file
mem - Memory mapped file, usually for share library

So 3r means webalizer has a descriptor number 3 associated with ...dns_cache.db, with read permission.

TYPE - File Type

In Linux, almost everything are files, but with different type.

REG - REGgular file, file that show up in directory
DIR - Directory

NODE

inode number in filesystem

You can find complete details in the man page.

Information on the meanings of the columns can be found in the lsof(8) manpage. I will address the ones you are asking about specifically.

cwd => current working directory
3r => file descriptor 3 opened for reading
DIR => directory
REG => regular file 

In order to unmount the drive, you will likely need to stop your webserver, and kill the webalizer process (since it's usually a batch job ran from cron).

In this scenario I usually use lsof in combination with ps to find out who is holding the device busy.

Let's take a example with a usb stick that was mounted as /media/disk-1

$> sudo umount /media/disk-1 
[sudo] password for cj: 
umount: /media/disk-1: device is busy.
 (In some cases useful info about processes that use
 the device is found by lsof(8) or fuser(1))

So I then try to find out who is holding the device with lsof.

$> lsof | grep disk-1
bash 7822 cj cwd DIR 8,33 16384 1 /media/disk-1

And since column 2 is the pid holding we can get the name of that process with ps.

$> ps -A | grep 7822
7822 pts/1 00:00:00 bash

Now that bash comes from a terminal that was open in a dir on the device, so at this point I could either close or kill that terminal so the device would be free again.

Update I don't think I answered the question, but maybe it could be helpful for someone else so I leave it anyway.