How to see which files are open on shares

Try smbstatus.

To pin down exactly which files are locked for use, try:

smbstatus | grep -i deny_write

For AFP, I'm not sure exactly how it's done -- there isn't an afpstatus command, so I'm a bit in the dark. However, you could probably use a combination of lsof and grep to find any objects of type REG and owned by applefile.

Maybe this:

sudo lsof | grep -i "^applefile" | grep REG

But that will return everything in use by the AppleFile service. From there, though, one may need to be familiar with what shares are on the system to further deduce what's open. For example, I get 10 lines returned, but only one of them contains a known share name (/Users/username/path/to/file), the rest are system directories (/System, /private, /usr, /Library and the like).

Hope this helps a bit.

I think the lsof command will tell you that root has the file open even if it's opened by an AFP user remotely. Looking at the AFP file access log would tell which user has it open.