Search/destroy old/idle user processes

Deviathan · 08-06-2007, 01:59 PM

Hi all,
I need to write a script to keep track of user-created processes on a linux server used for vnc connections. What I want to do is search for processes that are idle for at least a certain amount of time (say 2 weeks) before sending it a kill signal. I am aware of the command "w" and the "ps" command for use in my script. Unfortunately, w doesn't show the pid and ps doesn't give me an idle time. The only other thing was to combine the two results using the TTY number but I haven't really looked at implementing this yet. Are there any other commands or methods that I could use that might be more reliable? thanks for any input!

unSpawn · 08-06-2007, 02:22 PM

keep track of user-created processes on a linux server used for vnc connections
So those processes should (have been) be part of the session ID (SID) aka children of the VNC session? Else, if the users aren't allowed to run stuff in the background, maybe Do Something on X session logout (for instance /etc/X11/gdm/PostSession/*)?

ChrisScott · 08-06-2007, 02:38 PM

Hi,

You could try something like;

Code:

#!/bin/bash

ps -ef > .psef
SIZE=$((`cat .temprocs |wc -l |sed 's?[^0-9]??g'` - 1))
cat .temprocs | tail -$SIZE |awk '{print $2 " since " $5}' | grep -v "[0-9]\{2\}.[0-9]\{2\}" > .temprocs
rm -r .psef

that will give you everything over a day old (at least it does on my SuSE box). Some clever grep/sed/sort-ing could isolate procs started over a week ago. That method won't isolate idle processes though...

Maybe a nightly cron which loops through procs and straces them?

Still automated kills fill me with dread! Personally I'd just look though a 'ps -ef' every couple of days!