Hack75.Kill Processes the Right Way


Hack 75. Kill Processes the Right Way

The Linux kill command enables you to terminate processes normally or by using a sledgehammer.

If you spend much time as a Linux user or administrator, sooner or later you're going to have to end a process (often simply a program that no longer responds to user input or that just won't seem to go away). The safest way to kill a process is to simply use the kill command, with no modifiers or flags. First use the ps ef command to determine the process ID (PID) of the process you want to kill, and then simply type this command:

 # kill  -pid  

The standard kill command usually works just fine, terminating the offending process and returning its resources to the system. However, if your process has started child processes, simply killing the parent can potentially leave the child processes running, and therefore still consuming system resources. In order to prevent such so-called "zombie processes," you should make sure that you kill any and all child processes before you kill their respective parent processes.

8.8.1. Killing Processes in the Right Order

You can identify child process and their parents by using the Linux ps -ef command and examining each entry, looking at the column labeled PPID (parent process ID). However, if you're only interested in a specific family of processes, using the grep command makes life easier.

Let's look at an example. If we're trying to kill the httpd process, we'll need to kill its child processes before we can kill the parent. As a shortcut, use the following command to determine the PIDs that we'll need to terminate:

 # ps ef | grep httpd [root@aardvark kida]# ps -ef | grep httpd root 23739 1 0 Jun06 ? 00:00:07 /usr/sbin/httpd apache 24375 23739 0 Jul17 ? 00:00:01 /usr/sbin/httpd apache 24376 23739 0 Jul17 ? 00:00:00 /usr/sbin/httpd apache 24377 23739 0 Jul17 ? 00:00:01 /usr/sbin/httpd apache 24378 23739 0 Jul17 ? 00:00:00 /usr/sbin/httpd apache 24379 23739 0 Jul17 ? 00:00:00 /usr/sbin/httpd apache 24380 23739 0 Jul17 ? 00:00:01 /usr/sbin/httpd apache 24383 23739 0 Jul17 ? 00:00:00 /usr/sbin/httpd apache 24384 23739 0 Jul17 ? 00:00:01 /usr/sbin/httpd 

The first column tells us the user that owns each process, and the second and third columns tell us their PIDs and PPIDs, respectively. The first process listed, with the PPID of 1, is the parent process. When a process has a PPID of 1, that means it was started by init at boot time.

The first thing to try now that we have the parent process ID is to try to gracefully take it down by using the following command:

 # kill 1 23739 

The -1 option tells the kill command to attempt to end the process as if the user who started it has logged out. When you use this option, the kill command also attempts to go through and kill child processes left behind. This won't always work, thoughyou may still need to go through and kill child processes manually first, before killing the parent process. To kill more than one process at a time, simply separate the PIDs with spaces on the kill command line:

 # kill 24384 24383 24380 

A second option is to send a TERM signal to the parent process in an attempt to kill it and its child processes. This can be done using the following command:

 # kill TERM 23739 

Alternatively, you can attempt to kill all the processes within the same process group using killall. The killall command enables you to specify the names of the processes you want to terminate, rather than their PIDs, which can save you a lot of ps commands and eyestrain:

 # killall httpd 

8.8.2. Stopping and Restarting a Process

At some point, you might find yourself wanting to simply stop and restart a process. Instead of issuing the sequence of commands to manually kill and then restart your process, try using the following command:

 # kill HUP 23739 

This will have Linux perform the process shutdown gently, and then restart it immediately. This is especially handy when you're working on configuring an application that needs its process restarted after changes to its configuration files.

8.8.3. The Last Resort

If the regular kill or kill 1 commands don't work, you can always bring out the all-powerful kill 9 command:

 # kill 9 23739 

This extremely powerful and dangerous command forces a process to stop in its tracks, without allowing it to clean up after itself. This can lead to unutilized system resources and is generally not recommended unless all other options have failed.

After using the kill 9 (or the synonymous kill s SIGKILL) command, be sure to use ps ef again to make sure you don't have any zombie processes left. You can only eliminate a zombie process by terminating its parent process, which is fine if the parent process can safely be terminated or restarted but problematic if the zombie process has ended up being owned by the init process (PID 1). You do not want to kill the init process unless you know its implications and really mean to do that, because killing init will shut down your system. If you have zombie processes whose parent is init, and they are consuming significant amounts of system resources, you will need to reboot the machine at some point in order to clean up the process table.

8.8.4. See Also

  • man kill

  • man ps

Brian Warshawsky



Linux Server Hacks (Vol. 2)
BSD Sockets Programming from a Multi-Language Perspective (Programming Series)
ISBN: N/A
EAN: 2147483647
Year: 2003
Pages: 162
Authors: M. Tim Jones

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net