Originally Posted by Habitual
DO NOT USE THIS ON root
pkill -KILL -u $user
DO NOT ASK HOW I KNOW THIS.
"May" require sudo.
Does not work against a fork bomb. Fork bombs fork faster than pkill can find processes to kill...
Try this one: (NOTE THIS WILL CAUSE YOU PROBLEMS)
while (1) fork();
In the time it takes pkill to kill one process, this application will fork several hundred, each new process will then fork several hundred while pkill kills the next (plus the several hundred generated by each of previous processes...)
It will eventually hang your system UNLESS you have reasonable ulimits set. (I have 1024 concurrent processes...).
For me to run it then there would be 1023 maximum number of processes (after that, the fork fails).
Then, for each process that pkill manages to kill, any one of the other 1022 processes will replace it...
So... how do you stop it?
It isn't a single step operation, and works best when there are reasonable ulimits to prevent the system from hanging.
1. pkill -SIGSTOP -u <user>
This will put all of the users processes in the suspended state. And that means they will no longer be running. It also means that new processes cannot be started (the ulimit has been reached).
2. pkill -SIGKILL -u <user>
Now that the user processes are stopped, pkill can find each one and kill it.
Note: pkill may not exist on all systems (linux yes, Solaris, should be, but AIX/BSD... don't know)
See also: killall
There are also other strategies available - look at the fuser command where you know the file being used to hold the fork bomb.