How to immediately kill ALL processes for a Unix user

by Jared Still on Jan 24, 2018 12:00:00 AM

On occasion I have found it necessary to immediately kill all processes for a particular user on a Linux or Unix server. It has been quite some time since I found it necessary to do so, and the occasions for doing this have been rare. Even so, the following is a good thing to know. Let's say you found a user was running something on your database server that was consuming a lot of resources, and it appears there may be malicious intent. Or maybe the user has a runaway process that keeps spawning more processes, and neither you nor the user can kill the processes quickly enough to prevent spawning more processes. You might do something like this: First, check for the processes. Here we have 3 processes owned by baduser, and we want to kill these processes.

# top -b -n1 | head -12
 top - 15:40:26 up 25 days, 30 min, 10 users, load average: 0.46, 0.24, 0.28
 Tasks: 162 total, 5 running, 157 sleeping, 0 stopped, 0 zombie
 Cpu(s): 0.3%us, 0.1%sy, 0.0%ni, 99.4%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st
 Mem: 760524k total, 713756k used, 46768k free, 137960k buffers
 Swap: 3047420k total, 81056k used, 2966364k free, 55660k cached
 
  PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 
 26489 baduser 20 0 115m 1608 1064 R 33.4 0.2 0:00.48 ls 
 26483 baduser 20 0 115m 1608 1064 R 31.4 0.2 0:00.49 ls 
 26488 baduser 20 0 115m 1608 1064 R 31.4 0.2 0:00.48 ls 
  10 root 20 0 0 0 0 R 2.0 0.0 0:33.43 rcu_sched 
  1742 root 20 0 252m 80m 6708 S 2.0 10.8 6:14.70 Xorg

Now we login and attempt to kill those processes.

 [root@pythianvpn share]# kill -15 26489 26483 26488
 bash: kill: (26489) - No such process
 bash: kill: (26483) - No such process
 bash: kill: (26488) - No such process

What happened? Those ls processes have already completed, and another set has started:

# top -b -n1 | head -12
 top - 15:42:42 up 25 days, 33 min, 10 users, load average: 0.78, 0.61, 0.42
 Tasks: 162 total, 4 running, 158 sleeping, 0 stopped, 0 zombie
 Cpu(s): 0.3%us, 0.1%sy, 0.0%ni, 99.4%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st
 Mem: 760524k total, 728668k used, 31856k free, 138136k buffers
 Swap: 3047420k total, 81056k used, 2966364k free, 69676k cached
 
  PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 
 26602 baduser 20 0 115m 1764 1064 R 33.0 0.2 0:01.18 ls 
 26605 baduser 20 0 115m 1760 1064 R 33.0 0.2 0:01.18 ls 
 26604 baduser 20 0 115m 1764 1064 R 31.1 0.2 0:01.17 ls 
  10 root 20 0 0 0 0 S 1.9 0.0 0:34.46 rcu_sched 
  1 root 20 0 19408 420 208 S 0.0 0.1 0:00.54 init

Every time you try to kill these, a new set of processes has started. You could do this then; kill the parent processes as well.

# ps -ubaduser -o ppid,cmd
  PPID CMD
 16428 -bash
  1 /bin/bash /home/baduser/ck.sh 1
  1 /bin/bash /home/baduser/ck.sh 2
  1 /bin/bash /home/baduser/ck.sh 3
 26734 ls -lR /
 26735 ls -lR /
 26736 ls -lR /

So we need to kill all PIDs for ls -lR, and all PIDs for ck.sh There is potential for a lot of copying and pasting, so it is rather time consuming. Perhaps a little more command line fu is needed:

for pid in $(ps -ubaduser -o pid,ppid,cmd| tail -n +2| cut -f1 -d' ') 
 do
  kill -15 $pid
 done

That would work. But, there is an easier way to do this with kill -SIGNAL -1

\
 # time su - baduser -c 'kill -15 -1'
 
 real 0m0.112s
 user 0m0.003s
 sys 0m0.007s
 
 
 # top -b -n1 | head -12
 top - 15:51:27 up 25 days, 41 min, 10 users, load average: 1.73, 2.07, 1.28
 Tasks: 156 total, 1 running, 155 sleeping, 0 stopped, 0 zombie
 Cpu(s): 0.3%us, 0.1%sy, 0.0%ni, 99.4%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st
 Mem: 760524k total, 710864k used, 49660k free, 137788k buffers
 Swap: 3047420k total, 81064k used, 2966356k free, 55708k cached
 
  PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 
  3 root 20 0 0 0 0 S 2.0 0.0 0:17.87 ksoftirqd/0 
  1 root 20 0 19408 420 208 S 0.0 0.1 0:00.54 init 
  2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd 
  5 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:0H 
  6 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kworker/u:0

As you can see, that worked very quickly. How does it work? Checking the man page for kill reveals the answer:

 From 'man kill' on Oracle Linux
 
  -1 All processes with pid larger than 1 will be signaled.
 
 
 From 'man kill' on Linux Mint 18
 
  kill -9 -1 Kill all processes you can kill.

The -1</> option (that is a 'one') indicates to kill all processes with a PID gt 1. When logging in as the user via sudo and issuing kill -15 -1, kill will send the SIGTERM to all processes for that user. The man page may say to use SIGKILL or -9, but that should normally only be used as a last resort. If for instance we are trying to kill runaway processes, we may want to give the processes an opportunity to perform any cleanup they would normally do before terminating. SIGTERM allows for that, while SIGKILL does not. Here is how to see the complete list of signals:

 $ kill -l
  1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL 5) SIGTRAP
  6) SIGABRT 7) SIGBUS 8) SIGFPE 9) SIGKILL 10) SIGUSR1
 11) SIGSEGV 12) SIGUSR2 13) SIGPIPE 14) SIGALRM 15) SIGTERM
 16) SIGSTKFLT 17) SIGCHLD 18) SIGCONT 19) SIGSTOP 20) SIGTSTP
 21) SIGTTIN 22) SIGTTOU 23) SIGURG 24) SIGXCPU 25) SIGXFSZ
 26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 29) SIGIO 30) SIGPWR
 31) SIGSYS 34) SIGRTMIN 35) SIGRTMIN+1 36) SIGRTMIN+2 37) SIGRTMIN+3
 38) SIGRTMIN+4 39) SIGRTMIN+5 40) SIGRTMIN+6 41) SIGRTMIN+7 42) SIGRTMIN+8
 43) SIGRTMIN+9 44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12 47) SIGRTMIN+13
 48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14 51) SIGRTMAX-13 52) SIGRTMAX-12
 53) SIGRTMAX-11 54) SIGRTMAX-10 55) SIGRTMAX-9 56) SIGRTMAX-8 57) SIGRTMAX-7
 58) SIGRTMAX-6 59) SIGRTMAX-5 60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2
 63) SIGRTMAX-1 64) SIGRTMAX

This use of the kill command is quite powerful, so be very careful about how you use it.

How to immediately kill ALL processes for a Unix user

No Comments Yet

Subscribe by email

Share this

How to immediately kill ALL processes for a Unix user

Share this

No Comments Yet

Subscribe by email