is there no stopping a process started with nohup?

[Jonathan Corbeill]

I have a process that is chewing up resources on my system. It shows the parent process as init and shows a userid other than root. I cannot kill this process even with the -9 signal.

I was researching this and came across the hohup command. I think thats what is going on here. Is there any way to kill this process?

[Stefan Stechemesser]

if init is the parent process, then the proces was either started at bootup or later by init.
Examine the file /etc/inittab if the process appears there. If yes and you really know the process can be killed, set the process from respawn to off and do a "init q" after that (init rereads inittab and stops the process). Another way is to erase the line in /etc/inittab, do the init q and kill the process after that manually.
If all this does not work, reboot your machine after removing the inittab entry, the process will not be started during the next boot.
Be careful ! most processes in inittab are needed by the system. Which process makes the problem ?

If the command does not appear in inittab, it is started at bootup with the scripts under /sbin/init.d. If killing of the process does not work, it hangs during a kernel routine (I/O access etc.). Then it can only be killed by stopping the kernel (=> reboot), and you have to edit the config files under /etc/rc.config.d to prevent it being restarted at next bootup.

see manual pages init and inittab

[Paul Hite]

The nohup command can protect a process from some signals, but not SIGKILL which is what "kill -9 pid" does.

UNIX makes some guarantees that, for instance, disk read and write system calls are atomic. But one disk write system call could involve many operations. Until the system call completes, UNIX must protect the process from every signal. Sometimes this mechanism goes haywire and you get an unkillable process.

A reboot is often the only way to get rid of such a process. HP's glance program can often tell you why the process is hanging (on the wait states screen, type "W").

[Mike Plunkett]

Sounds like you also could be seeing "zombies" or "orphans"...child processes that have lost their parent for some reason. Basically, the child wants to exit with a return code to its parent. Since the parent is no longer there, it pends forever.

[Jim Welch]

Processes whose parents die and who don't die themselves should be adopted by init. But they should normally respond to a kill -9. I've seen some cases where a process is hung waiting for some hardware io and would not respond to a kill -9. About the only thing you can do is nice the heck out of the process and schedule a reboot and try to figure out what triggered the problem so you can try to avoid it in the future. Can you identify what product the process belongs to or what it does? (You could run glance and see what resources it is using and what system calls it is making if glance is installed on the system.)

[Dave Wherry]

A couple of other things you can try. As root do a kill -24 pid
This will send a STOP signal to the process and suspend it. It will not use up resources. It will sit there idle until you reboot or are able to kill it off.

If the parent of the process died or was killed then init, pid 1 will adopt the process. If the process is still eating up resources then it is obviously running. If it is not using resources it may be a zombie. Do a "ps -el | grep pid" to find the state of the process. Look in the 2nd column. That is the process state. If it is a Z the process is a zombie which means it is trying to exit, but, it can't. The process init is very good at killing its' children. You can try kill -18 1
In this case 1, init, is the parent pid. It will try to kill off it's zombie children. I've just learned this a couple of days ago and have not tried it. Be carefull with it.