ftp processes, and how to kill them with a cron

anon091 · 12-14-2010, 04:28 PM

if i do a

ps aux | grep ftp

that would show me at least any active ftp connects started with the ftp command, right?

Is there then a way to use that to somehow kill any stuck sessions that are older than an hour?

impert · 12-14-2010, 06:06 PM

I just did a little experiment:

Code:

kill -1 `ps aux | grep gedit | sed 's/://' | awk '{ if($10 > 10) print $2 }'`

killed a running gedit.
Something like:

Code:

kill -1 `ps aux | grep ftp | sed 's/://' | awk '{ if($10 > 100) print $2 }'`

might work for you. Please be careful and check that it can't kill anything that matters.

anon091 · 12-14-2010, 07:30 PM

does that kill the process no matter how long its running, or only if its over a certain "age" or idle for so long?

unSpawn · 12-14-2010, 08:52 PM

Code:

# I'd rather have epoch but at least 'ps' has an "elapsed time" switch:
\ps --no-header -o etime,pid,cmd -C ftp | while read TIME PID PROC; do
 # Time measured in days:
 if [ ${#TIME} -ge 9 ]; then echo "pkill -9 ${PID} ("${PROC}" ${TIME})"
 # ...in hours:
 elif [ ${#TIME} -eq 8 -a ${TIME:1:1} -ge 1 ]; then echo "pkill -9 ${PID} ("${PROC}" ${TIME})"
  # just too young to die..:
 else echo "leaving "${PROC}" ${TIME} alone."; fi; done

impert · 12-15-2010, 05:10 AM

Quote:

does that kill the process no matter how long its running, or only if its over a certain "age" or idle for so long?

If you look at a line from ps aux like:

Code:

cam      18555  4.3  0.1 345992  6736 ?        Ssl  11:27   0:43 /usr/bin/pulsea

the tenth field is the time elapsed - 0:43 in the example above. It's in HH:mm format. sed strips the : out of the line, and awk checks to see if the value of the tenth field ($10) is > 100 ie 1 hour 00 minutes, (this was what you asked for) and "prints" the process number (second field, $2) to the kill command, which may or may not kill it. You could put $10 > 200 for 2 hours or $10 > 30 for 30 minutes.
kill -1 often won't kill hung processes - kill -9 will, but without tucking them into bed nicely. kill -3 might be about right. See man kill
However, you're probably better following unSpawn's advice than mine.

anon091 · 12-15-2010, 12:00 PM

I'm not even sure I know how to use unSpawn's advice haha, i think its way over my head.

unSpawn · 12-15-2010, 12:48 PM

--no-header: don't display ps header
-o: display only these items
etime: elapsed time
pid: the process identifier
cmd: the command line, also called "args"
-C ftp: only select processname "ftp"
| while read TIME PID PROC; do: make the shell read in the three variables and
if [ ${#TIME} -ge 9 ]; then: if the amount of chars in the variable TIME is greater or equal to 9 (think "33-21:09:03" or 33 days, 21 hours etc), then
echo "pkill -9 ${PID} ("${PROC}" ${TIME})": echo what we should do: when unsure display rather than execute things. Else if
elif [ ${#TIME} -eq 8 -a ${TIME:1:1} -ge 1 ]; then: if the amount of chars equals 8 (think "21:09:03"), then
echo "pkill -9 ${PID} ("${PROC}" ${TIME})": again echo what we do. Else we just
else echo "leaving "${PROC}" ${TIME} alone."; fi; done: echo and be done with it.

In short removing the "echo" and outer double quotes from the 'pkill' lines would allow for execution. Like impert stated before you should be aware of what you kill ('ps' doesn't allow for filtering like 'pgrep -f ".*some.*random.*string*" does) so running it manually on the machine and echoing output should show if it works for you.

anon091 · 12-15-2010, 01:05 PM

Thanks for the explanation, and making it safe so i dont blow up a server ;-)

I'll try it out, but it sounds like this is just what i'm looking for.

impert · 12-16-2010, 06:52 AM

@ unSpawn: That's a great little mini-tutorial! Thanks.

unSpawn · 12-16-2010, 04:46 PM

Actually I don't do tutorials but you can always read some:
http://www.tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html
http://www.tldp.org/LDP/Bash-Beginne...tml/index.html
http://wooledge.org/mywiki/BashFAQ?a...direct=BashFaq
http://wooledge.org/mywiki/BashPitfalls
http://www.tldp.org/LDP/abs/html/
that's better than I can explain things.