Unix Tip: Terminating unattended processes

A reader recently asked how he could most easily terminate processes that were left running after his users had logged off a system. The processes in question were apparently consuming resources needed by other services and were not contributing to any particular project. What he was looking for, however, was a solution that would not require him to detect the processes and manually terminate them, even if commands such as "pkill -u username" might simplify the job.

The possibility of using some form of .logout file crossed my mind. However, .logout files don't appear to be universally effective and, by nature, belong to the individual users. To be effective, only a tool that would not be subject to the prerogative of the users in question would do.

The first step in identifying a good solution to this problem was selecting the processes to be terminated. If a user logged in to the system again, we would not want to terminate his current login. Processes that continue running after a user has logged out lose their assigned terminal. That is, they are listed as running on TTY "?" like jdoe's process in the listing below.

     UID   PID  PPID  C    STIME TTY      TIME CMD
    root     0     0  0   Jun 27 ?        0:00 sched
    jdoe 15540     1  0 16:30:17 ?        0:00 /bin/bash /home/jdoe/job

Numerous critical system processes, as also illustrated in this output, are not associated with particular TTYs. The scheduler, a critical system process, is just one of many processes that must be running for a system to function properly. If you run a ps command to count the number of such processes, you will see something like this:

# ps -ef -o tty | grep "?" | wc -l
      60

Clearly, we need to be very selective about the processes we kill.

So, let's say we want to terminate all of jdoe's processes that are not associated with a current login session. We want something that uses the logic "select PID where UID=jdoe and TTY=?".

boson# ps -ef -o user,pid,tty | grep jdoe
jdoe 15540 ?
jdoe 16421 ?
jdoe 14437 ?
jdoe 15790 pts/1
jdoe 14439 pts/1

If we further select the lines containing "?" characters and then narrow down the output to the middle column, we're almost there.

boson# ps -ef -o user,pid,tty | grep jdoe | grep "?" | awk '{print $2}'
15540
16646
14437

The only problem with this approach is that there's a small risk of including some other user's processes in the mix of the second username includes the first username. For example, mjdoe's unattended processes processes would also be selected.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine