I regularly access my linux shares from my Macbook, and occasionally when I want to "eject" or unmount the network volume, Mac OS complains that there are files open. One solution is the "force eject" option, but I always wonder if that will leave garbage around in a cache file somewhere, or have other unknown consequences. The solution I've found is to first identify which files are open, then kill the process that's holding onto the file handle. This may not be any better than just using the force eject option, but it makes me feel like I'm i control of what's going on. Let's assume my server is named "Archimedes":
1. Who's got that file?
charles$ lsof | grep Archimedes
QuickLook 903 charles 5r REG 51,6 462624 9869 /Volumes/Archimedes/Backups/building_blocks.jpg
The first output column is the name of the process. QuickLook is often the culprit here. The second column shows the process ID, which we'll need for step two. You can safely kill the QuickLook process, but if the process is, for example, "Microsoft Word", then you probably want to make sure you save and close that file from the associated application.
2. Kill that process
kill -9 903
That should do it. If I were really clever, I'd write a bash script that uses sed or awk to pull the PID from the first command and pipe it to the second, but that will have to wait until I finish my other 42 projects.