ECN No Name Newsletter: April, 1994

The ECN No Name Newsletter is no longer being published. This is an archived issue.

[previous article] [next article]

Eliminating A Process While Avoiding Harmful Side Effects

NO NAME NEWSLETTER Article, April 1994

Kent De La Croix

When faced with a misbehaving process that is in need of elimination, you first need to determine the pid (Process Identification Number) of the rogue process. This can be done by using the ps (Process Status) command to list all of your processes.

If you are on a System V based system (HP and Solaris 2.x hosts) you would use "ps -u " , where "" is your login name. On BSD based systems (NP1, VAX, and SunOS 4.x hosts) to obtain the same sort of listing, you would type "ps -xg" . In my account, for example, if I wished to kill a runaway a.out process, I would type "ps -u kcd" . This reveals that 10371 is the pid of the process I wish to eliminate.

        %   ps -u kcd
           PID TTY       TIME COMD
           24393 pts/4   0:00 ps
           10251 ?       0:08 xterm
           10256 pts/0   0:02 csh
           10371 pts/0   12:37 a.out
           24378 pts/4   0:02 csh
Now that the pid of my problem process is known that information can be combined with a kill command to eliminate the process.

You first attempt a simple "kill " . If the process fails to vanish try "kill -HUP " . If the process is still hanging on there is one more thing you should try before resorting to the deadly kill -9 (see the warning in the next column about kill -9). It may be that your process is waiting on its "children" to die before it will go away. To find these "child processes" use one of the following techniques (in each case is the process id of the process you are trying to kill).

On System V based systems (HP and Solaris 2.x hosts) elf flags request long output of all jobs on the system:

         ps -elf | egrep "|PPID"
On BSD based systems (NP1, VAX, and SunOS 4.x hosts) axl flags request long output of all jobs on the system:

         ps -axl | egrep "|PPID"
Now look at the output and find all occurrences of in the column headed "PPID" (Parent Process ID). These are all of 's children. Look up their pid's in the column headed "PID" and try killing them using the procedure given above. Keep doing this until you've tried to kill and kill -HUP all of 's children, grandchildren, great grandchildren, etc.

Finally, if you come across a process that has no children and still exists after being killed and kill -HUPed, then you will have to resort to using kill -9 to eliminate it. As an example, let us assume I am trying to kill off my "xinit" process, pid 409, on my workstation. Assume I have tried "kill 409" and "kill -HUP 409" but the process has not died. Now I would:

  % ps -elf | egrep "409|PID"
   F   S   UID   PID   PPID ... COMD
   8   S   kcd   4092   256 ... xinit
   8   S   kcd   411    409 ... sh /home/harbor/kcd/.xinitrc
   8   R   kcd   410    409 ... X -auth /home/harbor/kcd/.Xauthorit
   8   S   kcd   21475  766 ... egrep 409|PID
Looking for 409 in the PPID column I see 409 has two children, 411 and 410. I would try "kill 411" and "kill 410" . Assume 410 dies, but 411 does not. So I try "kill -HUP 411" , still no luck, the next action is:

  % ps -elf | egrep "411|PID"
   F   S   UID   PID    PPID ...  COMD
   8   S   kcd   411    409  ...  sh /home/harbor/kcd/.xinitrc
   8   S   kcd   414    411  ...  xterm -C -name console +ut
   8   S   kcd   21499  766  ...  egrep 411|PID
With this listing I see 411 has one child, 414. If I am successful in killing 414 off, then 411 should go away on its own closely followed by 409. If not, then I would resort to "kill -9 414" , followed by "kill -9 411" if 411 is still running, and finally "kill -9 409" if 409 was still around at this point.

KILL -9 CONSIDERED HARMFUL

Although "kill -9 " is very effective in stopping an errant process and thus often becomes an individual's preferred method of eliminating rogue jobs, it can have some nasty side effects. "kill -9 " asks the UNIX kernel to destroy a process without giving that process a chance to clean up after itself. If the process you are killing has adjusted your port settings (ex: vi) or has reconfigured your display and/or keyboard settings (OpenWindows, Sunview or X) using kill -9 to eliminate the process can leave your terminal or workstation unusable. In some cases, a reboot is needed to recover the use of the workstation's keyboard and monitor.

For this reason it is wise to use "kill -9 " ONLY as a last resort.

webmaster@ecn.purdue.edu
Last modified: Saturday, 13-Sep-97 01:58:12 EST

[HTML Check] HTML