Proper Kill

[Ted Flanders]

I was reading yesterday not to use a kill -9 because it doesnt clean up files. This is the way that I was taught to kill. What I do is ps -ef user, shutuser, then kill processes with a kill -9 "pid". What is the correct way to do this?

[John Payne_2 · Accepted solution]

try a 'kill ' or if you are drawn the the kill with a number option, 'kill -6 ' A good rule of thumb is to try this a couple of times before resorting to stomping on it with a 'kill -9'... This should allow the process to hangup before it exits.

Have fun.

John

[A. Clay Stephenson]

Hi Ted,

I won't say that kill -9 is always bad, it simply should be the weapon of last resort because of the cleanup issue that you mentioned.

My way is
kill -15 $pid
kill -1 $pid
kill -2 $pid
kill -3 $pid
kill -11 $pid.

Kill -11 will clobber almost as well as kill -9 and can be caught and thus cleanup can be done. Only when the above are exhausted and you really need to kill something should you then bring out the big hammer, kill -9. A good technique is to send kill -0 $pid after each attempt to see if the pid is still valid and thus the process is still out there.

Regards, Clay

[James R. Ferguson]

Hi:

A 'kill -9' can't be trapped and therefore doesn't give the recipient any chance to cleanup files and/or shared memory.

It is far cleaner to issue a simple 'kill' (kill -15) or a kill -1 (kill -hup) *first*; wait a few seconds; and then as a last resort, if necessary, issue a kill -9.

Remember that zombies or processes hung waiting on an IO are *not* going to vanish even with a 'kill -9'.

Regards!

...JRF...

[Uday_S_Ankolekar]

Hi,

Kill -11 is equivalent to -9 but it cleans up..
-USA..

[harry d brown jr]

Ted,

Another good rule of thumb, is to get the "lsof" command from:
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.55/

and use this to determine what files a process has open, because the last thing you want to be doing is clobbering a process that is updating files.


live free or die
harry

[Darrell Allen]

Hi Ted,

kill -9 is nasty and should be used as a last resort. It is most likely able to kill the process (processes hanging on an I/O request appear immune to -9) but it is the equivilant or cracking a nut with a sledge hammer. You just don't know what damage you may be doing to your application.

Always, always try kill -15 first.

Darrell

[Ted Flanders]

Ok........so what do you mean that it "cleans up" or "traps" or can be "caught"? Sorry to ask, but if I dont, I will never know. "A kill -9 cant be Trapped and therefore doesnt give the recipient time to cleanup files or shared memory." I am a little confused by this. When I kill someone it is usually because they are locked up and cant do anything. How would they be able to cleanup files in this case?

[James R. Ferguson]

Hi (again) Ted:

A signal can be "trapped" (or "caught"). A trap is an interrupt handler. When a signal is received, an interrupt is executed. That is, a 'jump' to an interrupt (trap) routine is made and any code associated with the trap is executed.

If you look at /etc/profile, you wiil see a classic trap at the beginning:

trap "" 1 2 3

This says, "do nothing" (as denoted by the empty command ("")) upon receipt of signals 1 or 2 or 3 (hup, int, quit). Thus, the user can stike the CNTL_C key combination and break out of /etc/profile.

At the very end of /etc/profile you see:

trap 1 2 3

This restores the signals hup, int and quit.

For more information, have a look at the man pages for 'kill' and 'signal'.

Regards!

...JRF...

[James R. Ferguson]

Hi Ted:

Sorry, that should read: "Thus, the user *cannot* strike the CNTL_C key combination and break out of /etc/profile."

Here's another simple example:

#!/usr/bin/sh
typeset -i N
trap "echo killed!;exit 1" 15
echo $$
while (( N <= 30 ))
do
let N=N+1
date
sleep 1
done
exit 0

If you run this script, you see the process's pid echoed followed by 30 displays of the current time. When it is running, if you do:

# kill

...or kill -15

...then the script will echo "killed!" and exit with a return code of <1>.

The point is that you could do anything you wanted -- remove files, etc. etc.

Regards!

...JRF...

[Darrell Allen]

Hi again,

Certain signals can be trapped - meaning the process will branch to a section of code to perform some other processing. This could be things like rolling back an update, deleting temp files, or verifying the integrity of the data it was processing. The process could also be written to simply ignore the signal and it could be written with different sections of code for different signals.

A signal that can not be trapped means the process can not do any special processing based on that signal. In the case of -9 the process is killed without regard for whatever it was doing at the time. You can probably guess that it's not a good thing to do, particularly with something like a database or OnLine Transaction Process.

A real life example would be making a withdrawal from an ATM. If the order is to debit my account then dispense my money, I'd defintely be unhappy if that process was killed with a -9 after the debit was made but before the money was spit out.

Darrell

[A. Clay Stephenson]

Hi Ted:

To amplify what Jim has said and to make it even more general, SIGKILL (kill -9) can't be caught. This applies not only to the shell using 'trap' but to any process. Most well behaved executables use either default signal handlers or custom signal handlers to handle
events. If you really want to know how this stuff works at the 'molecular' level then you should study the man (2) pages for signal and kill and the (3C) pages for setjmp and longjmp. If you grasp it at this level then you will absolutely nail it at the shell script level. For the 'atomic' level, you need to look at kernel internals but that's beyond the scope of this course.

Food for thought, Clay

[gimini]

Hi Ted,
I do not know exactly what the problem is,but as i understood from your message that you try to kill a procces but it keeps running after teh kill command.If that is the case ,have tried to kill the procces's parrent procces?
As far as i know if a procces comes back running whis different ID no. after each kill,
then it has parrent procces.
Regards.