Re: Killing session remotely?
On Wed, Apr 25, 2001 at 07:26:14AM -0700, Pad Bambury wrote:
> Hey Richard,
> thanks for the advice. Must confess serious newbie
> status however and am very chary of messing stuff up.
> How would I find the pid exactly? Say the user acc
> was called jeff. Should I
> 1. shell in under my own acc
> 2. then su to jeff? or just run ps aux?
ps aux will tell you a whole lot about every process you've got.
if you're merely looking for the process id (PID) of a
well-behaved* daemon, you can probably just do
pidof apache
pidof kdm
Then again sometimes you need the PID of a joe-user process, and
that's when you need "ps".
* here, well-behaved is one that leaves a trail of breadcrumbs in
expected places, such as a pid-file in /var/run/daemonname.pid
that contains its process id.
> Have done so, and ps aux seems only to give status up
> until Apr 20, 3 days before session started, and for
> recent processes today. Not even sure of what to look
> for exactly.
% ps aux
PID TTY STAT TIME COMMAND
30597 ? SW 0:00 [safe_mysqld]
30610 ? S 0:11 \_ /usr/sbin/mysqld --pid-file=/var/run/mysqld/mysqld.pid
30612 ? S 0:11 \_ /usr/sbin/mysqld --pid-file=/var/run/mysqld/mysqld.pid
30613 ? S 0:00 \_ /usr/sbin/mysqld --pid-file=/var/run/mysqld/mysqld.pid
24490 ? S 0:22 /usr/sbin/apache
4209 ? S 0:00 \_ rotatelogs /var/log/apache/error.log 86400
5956 ? S 0:00 \_ /usr/sbin/apache
6175 ? S 0:00 \_ /usr/sbin/apache
6336 ? S 0:00 \_ /usr/sbin/apache
6446 ? S 0:00 \_ /usr/sbin/apache
6779 ? S 0:00 \_ /usr/sbin/apache
23556 ? S 0:37 /usr/sbin/sshd
10404 ? S 0:31 \_ /usr/sbin/sshd
10405 pts/0 S 0:01 \_ -tcsh
28273 pts/0 T 0:00 \_ -sh
7397 pts/0 S 0:05 \_ mutt -y -e push Od
7668 pts/0 S 0:00 \_ vi /tmp/mutt-server-7397-62
7685 pts/0 S 0:00 \_ -usr/bin/tcsh -c (ps afx) < /tmp/viUmUNe8 >&/tmp/voYvP4i6
7693 pts/0 R 0:00 \_ ps afx
Here the "TIME" column shows how much sweat that process (and its
children since its beginning) has required from the cpu.
You can see that there's one apache mongo process, with
"rotatelogs" as a child and five actual server apache processes
underneath it.
You can also tell that i called "ps afx" as a shell escape from
within my vi session, which was invoked via mutt (where i read
your message) which in turn was called from my tcsh command line.
Going further, that tcsh login shell was spawned by sshd, so you
can also tell that i'm not using a console keyboard to enter all
this -- rather, i logged in remotely (from upstairs, but there's
no difference between that and connecting from Perth) using the
secure shell protocol (ssh).
compare the above "ps" listing with this one:
23556 ? S 0:37 /usr/sbin/sshd
10404 ? S 0:32 \_ /usr/sbin/sshd
10405 pts/0 S 0:01 \_ -tcsh
28273 pts/0 T 0:00 \_ -sh
7397 pts/0 T 0:05 \_ mutt -y -e push Od
7668 pts/0 T 0:02 | \_ vi /tmp/mutt-server-7397-62
7927 pts/0 R 0:00 \_ ps afx
Here you can see i got out of vi (i used ^Z) back to my shell,
and ran "ps afx" from there. This time i used the mouse to cut
(leftbutton-drag to select) and paste (middlebutton (both buttons
simultaneously to simulate middle on a 2-button mouse) click) the
results, instead of having vi capture the "ps" listing directly.
Also, since i've got "update-alternatives" set to treat a request
for "vi" as if it were to invoke "vim" you can't tell which
particular instance of "vi" i'm using. All you see is "vi" which
could be elvis, nvi, vim or even the original vi (and maybe other
alternatives exist that i don't even know about).
But i digress...
In my case, if you wanted to try killing all of my current
processes (i.e. the sshd, tcsh, mutt, vi group) you might try
killing the topmost ancestor, which in this case would be #10404
(assuming that the 23556 daemon is the one that listens for
initial connections from Out There; we wouldn't want to zap that
and leave the system in an unexpectedly deaf state).
You never know, sometimes the "kill grandpa and the whole family
dies" works via trickle-down... and sometimes it doesn't. Then
you have to hunt down the durable family members and annihilate
them one-by-one.
> In other words the command "last" shows the user jeff
> still logged in, but ps aux gives no processes for
> jeff.
right. "last" shows most recent logins, as in "when did bubba
LAST login?" "who" and "w" show current logins.
> Any way out of this?
there's usually a way out. it's usually pleasant, too, but not
always. ("remember the birth canal!")
> Thanks,
> Pad.
>
> --- punt45ACP@netscape.net wrote:
> > Get in remotely, do an "su -" and a "kill -9 <pid>"
> > That should do the job!
and sometimes "kill" lets you specify the daemon by name, as in
kill apache
kill -HUP postmaster
--
DEBIAN NEWBIE TIP #4 from Will Trillich <will@serensoft.com>:
Want to know WHAT FILES PACKAGE x-y-z PROVIDES? This is a job for
dpkg: enter "dpkg -L <package-name>" at the command prompt.
Try "dpkg -L netbase | pager" for example.
Also see http://newbieDoc.sourceForge.net/ ...
Reply to: