Batman @ Work

The scenario

Lets imagine we have a couple of rogue ‘apache2’ processes. This in no way implies that apache provide rogue processes – it is merely used as an example.

First just list all running processes (subset shown)

$ ps ef

root 5726 0.0 0.0 1856 304 ? Ss 06:08 0:00 /usr/bin/ ...
root 5727 0.0 0.0 1860 304 ? Ss 06:08 0:00 /usr/bin/vmnet-dhcpd -cf ...
root 5738 0.0 0.3 20944 6448 ? Ss 06:08 0:00 /usr/sbin/apache2 -k start
www 5755 0.0 0.7 28608 14480 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5756 0.0 0.6 27304 13384 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5757 0.0 0.6 27508 13092 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5758 0.0 0.5 26464 12056 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5759 0.0 0.5 25664 11192 ? S 06:08 0:00 /usr/sbin/apache2 -k start
root 5830 0.0 0.0 2948 620 ? Ss 06:08 0:00 /usr/bin/kdm
root 5851 0.8 2.5 55928 51996 tty7 Ss+ 06:08 1:31 /usr/bin/X -br -nolisten tcp :0 vt7 -auth ...
root 5869 0.0 0.0 3932 1460 ? S 06:08 0:00 -:0
bruce 5961 0.0 0.0 1756 536 ? Ss 06:08 0:00 /bin/sh /usr/bin/startkde
bruce 6004 0.0 0.0 4432 588 ? Ss 06:08 0:00 /usr/bin/ssh-agent /usr/bin/startkde

or then for a specific user –

$ ps efu -u www

www 5755 0.0 0.7 28608 14480 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5756 0.0 0.6 27304 13384 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5757 0.0 0.6 27508 13092 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5758 0.0 0.5 26464 12056 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5759 0.0 0.5 25664 11192 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5961 0.0 0.0 1756 536 ? Ss 06:08 0:00 /bin/sh /usr/bin/startkde
www 6004 0.0 0.0 4432 588 ? Ss 06:08 0:00 /usr/bin/ssh-agent /usr/bin/startkde

now filter out only those processes we’d like to kill

$ ps efu -u www | grep ‘apache2’

www 5755 0.0 0.7 28608 14480 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5756 0.0 0.6 27304 13384 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5757 0.0 0.6 27508 13092 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5758 0.0 0.5 26464 12056 ? S 06:08 0:00 /usr/sbin/apache2 -k start
www 5759 0.0 0.5 25664 11192 ? S 06:08 0:00 /usr/sbin/apache2 -k start

now extract the second column i.e. the process id

$ ps efu -u www | grep ‘apache2’ | awk ‘{print $2}’

5755
5756
5757
5758
5759

and finally kill them all

$ ps efu -u www | grep ‘apache2’ | awk ‘{print $2}’ | xargs rm -f

All of your apache2 processes for user www have been killed.

As always, there are probably hundreds of ways of doing this, and probably many more elegant | more efficient | faster | easier | etc | etc | etc… This particular one worked for me on the day.

I hope you find it helpful!

Powered by Zoundry Raven

Technorati : apache, awk, bash, grep, rogue
Del.icio.us : apache, awk, bash, grep, rogue
Zooomr : apache, awk, bash, grep, rogue
Flickr : apache, awk, bash, grep, rogue