Cool way to nuke rogue processes
The scenario
Lets imagine we have a couple of rogue ‘apache2’ processes. This in no way implies that apache provide rogue processes – it is merely used as an example.
First just list all running processes (subset shown)
$ ps ef
root 5726 0.0 0.0 1856 304 ? Ss 06:08 0:00 /usr/bin/ ... root 5727 0.0 0.0 1860 304 ? Ss 06:08 0:00 /usr/bin/vmnet-dhcpd -cf ... root 5738 0.0 0.3 20944 6448 ? Ss 06:08 0:00 /usr/sbin/apache2 -k start www 5755 0.0 0.7 28608 14480 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5756 0.0 0.6 27304 13384 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5757 0.0 0.6 27508 13092 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5758 0.0 0.5 26464 12056 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5759 0.0 0.5 25664 11192 ? S 06:08 0:00 /usr/sbin/apache2 -k start root 5830 0.0 0.0 2948 620 ? Ss 06:08 0:00 /usr/bin/kdm root 5851 0.8 2.5 55928 51996 tty7 Ss+ 06:08 1:31 /usr/bin/X -br -nolisten tcp :0 vt7 -auth ... root 5869 0.0 0.0 3932 1460 ? S 06:08 0:00 -:0 bruce 5961 0.0 0.0 1756 536 ? Ss 06:08 0:00 /bin/sh /usr/bin/startkde bruce 6004 0.0 0.0 4432 588 ? Ss 06:08 0:00 /usr/bin/ssh-agent /usr/bin/startkde
or then for a specific user –
$ ps efu -u www
www 5755 0.0 0.7 28608 14480 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5756 0.0 0.6 27304 13384 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5757 0.0 0.6 27508 13092 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5758 0.0 0.5 26464 12056 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5759 0.0 0.5 25664 11192 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5961 0.0 0.0 1756 536 ? Ss 06:08 0:00 /bin/sh /usr/bin/startkde www 6004 0.0 0.0 4432 588 ? Ss 06:08 0:00 /usr/bin/ssh-agent /usr/bin/startkde
now filter out only those processes we’d like to kill
$ ps efu -u www | grep ‘apache2’
www 5755 0.0 0.7 28608 14480 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5756 0.0 0.6 27304 13384 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5757 0.0 0.6 27508 13092 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5758 0.0 0.5 26464 12056 ? S 06:08 0:00 /usr/sbin/apache2 -k start www 5759 0.0 0.5 25664 11192 ? S 06:08 0:00 /usr/sbin/apache2 -k start
now extract the second column i.e. the process id
$ ps efu -u www | grep ‘apache2’ | awk ‘{print $2}’
5755 5756 5757 5758 5759
and finally kill them all
$ ps efu -u www | grep ‘apache2’ | awk ‘{print $2}’ | xargs rm -f
All of your apache2 processes for user www have been killed.
As always, there are probably hundreds of ways of doing this, and probably many more elegant | more efficient | faster | easier | etc | etc | etc… This particular one worked for me on the day.
I hope you find it helpful!
Powered by Zoundry Raven