Script to kill dead and old user processes

[TheJuiceman]

Hey gang,

I need some script help. I am in need of a script that can accomplish the following:

- find a particular process (a known process run by multiple users) that is over say 24 hours old and execute a kill.
- find user processes (would be same as above process type) that are older than several hours that are consuming over 90% CPU and kill them.
- build in some safety nets in place to prevent killing processes that are needed (like active sessions)

Any assistance is appreciated. Thanks.

[TheJuiceman]

oh, just a note...the "dead" processes will not necessarily show up as "defunct". Thanks.

[James R. Ferguson]

Hi:

Since you know the process name, find it (or them) by name using the XPG4 option of 'ps':

# UNIX95= ps -C vxfsd -o pid= -o uid= -o time= -o tty= -o comm=

The "=' character suppresses the heading. In the above, you would be returned the pid of the process named "vxfsd" along with the processes's effective owner, the elapsed time, the controlling terminal and the command name.

These five fields should allow you to skip "system" processes (e.g. those with a 'uid' less than, for example 100 -- a convention) and/or those not associated with a terminal.

Your script can then parse these field values and use the pid for a kill.

I advise you to issue a 'kill -hup' followed by a simple 'kill -term' and finally only as a last restort, a 'kill -9' if you must terminate. This gives a process an opportunity to cleanup temporary files and shared memory segments.

If you are running 11.31, then take a look at 'pkill(1).

Regards!

...JRF...

[James R. Ferguson]

Hi (again):

> oh, just a note...the "dead" processes will not necessarily show up as "defunct". Thanks.

That matters not. An entry in the process table that is marked as "defunct" is a zombie. Since zombie's are already dead (with only a process table entry yet to be reaped by its parent) they can't be killed.

You might want to include the parent pid ('ppid') in your process table selection. Seeing a parent process pid=1 (for 'initd') might help indicate a "dead" process in your environment --- assuming that your application doesn't daemonize itself.

Regards!

...JRF...

[Aneesh Mohan]

Hi James,

Sorry to post my query in other user post.

Regarding your last point in the last repy

>> Seeing a parent process pid=1 (for 'initd') might help indicate a "dead" process in your environment


# UNIX95= ps -C tnslsnr -o pid= -oppid= -o uid= -o time= -o tty= -o comm=
14348 1 103 00:00:30 ? tnslsnr
#

The PPID of the Oracle listner is "1" (init),and the process is active currently.

Could you please flash more light on this.

Thanks
Aneesh

[Dennis Handly]

>JRF: Since zombie's are already dead (with only a process table entry yet to be reaped by its parent) they can't be killed.

Zombies can be killed by killing the zombie master, parent.

>Aneesh: The PPID of the Oracle listner is "1" (init) and the process is active currently. Could you please flash more light on this?

This may be the case of the listener making itself a demon.
Or when the parent dies, init adopts/reaps the children.