Terminating multiple processes query

[ITeam]

Hi.

Server running HPUX 11.00:

User: bh has logged off but has left about 100 processes running (ps -ef | grep bh). I have tried killing these off from the bottom up, to no avail (kill & kill -9). They seem to be respawned under a new pid each time.

When I run the 'top' command I usually receive several of these 'bh' processes within the top ten. They are not always the same ones though.

Rebooting is a last resort in this case. Any suggestions on locating the origin of this problem?

Much appreciated.

[A. Clay Stephenson]

Look for the parent's PID (PPID) and try to kill that process.

[Chan 007]

Some time,

kill -15 is better for that.

Try that.

else do a ps -ef |awk '{print $2} >/tmp/pids
for i in $(cat /tmp/pids)
do
kill -9/15 $i
done

Chan

[Steve Steel]

Hi


ps -l -u bh

Try killing the PPID before the PID if it is not 1


Otherwise post the ps output


Steve Steel

[Jeff Schussele]

Is the parent PID always the same?
If so, kill it & it may take all it's children with it.
Just don't kill PID #1

HTH,
Jeff

[ITeam]

Thanks for the prompt responses.

It seems there are more than one or two parent processes. When I try to locate & kill them, I seem to get nowhere.

Please see the attached list using:
'ps -l -u bh'

Cheers.

David

[Peter Nikitka]

Hi,

it looks like someone wrote a script containing
a line
*
or something like that which matches itself and breaks your system.

I would temp. move 'bash' to a different place,
try to kill the remaining processes and have a serious discussion with this user.

mfG Peter

[ITeam]

Tried moving bash to another location & killed the pid spawned by pid: 1. Checked & another one was spawned by pid: 1. I could not removed the bash file outright as it was shown as in use.

[A. Clay Stephenson]

Okay let's try something a little different and hopefully all these processes share a common process group:

Do a:

UNIX95= ps -ej | pg

and note the PGID value for these runaway shells. Again, hopefully these bad boys share a common PGID (2nd column) or these processes use a small set of common PGID's:

What you want to do is send a signal (via kill) to this process group. This is done
by rather than sending kill -PGID to the process group.

For example if we want to send signal 11 (SIGSEGV) to add the members of PGID 3005 then "kill -11 -3005" would do that. Note that kill -11 is almost as deadly as kill -9 but does cleanup. Kill -ll is my "next to weapon of last resort".

[Peter Nikitka]

Hi,

I would definitly try this more than once and with different signals:

kill `UNIX95=1 ps -u bh -C bash -o pid=`

mfG Peter

[Rodney Hills · Accepted solution]

To terminate all processes for a user, you can do the following-

export UNIX95=1 ; ps -u rbadmin -o pid= | xargs -n1 kill -9

This will get all the pids for a user and feed it to "xargs" who will execute a kill -9 on each of them.

HTH

-- Rod Hills

[ITeam]

Those commands look like they will do the trick. Unfortunately, it seems that I need to install a patch to enable use of the -o & -j for the ps command. This will require a reboot which I need to avoid (today at least)!

Is there any other way to see the PGID column?

Also, Rodney: I am confused by the rbadmin part of the command you wrote. What part of the command do I need to add the user details 'bh' to?

Many thanks.

David

[Peter Nikitka]

Hi,

did you really call the 'ps' with UNIX95-environment set? If not, the option(s) will not be recognized as valid.
Call the ps-command(s) (without the 'kill'-part) exactly as noted!

Another try: remove the execute-flag from 'bash'.

mfG Peter

[ITeam]

Problem resolved - thanks ever so much everyone!

I used the command:

export UNIX95=1
ps -u bh -o pid= | xargs -n1 kill -9

Killed all the required processes. Tried a kill & kill -11 first with no success.

Cheers.