[SOLVED] find and kill process through lsof marked as deleted

procfs · 06-07-2016, 04:39 AM

Hi can any one help me to write a script, to find and kill process that own a file marked as deleted in lsof and file size is greater than 2GB

Thanks and Regards

Turbocapitalist · 06-07-2016, 05:07 AM

Quote:

Originally Posted by procfs

Hi can any one help me to write a script, to find and kill process that own a file marked as deleted in lsof and file size is greater than 2GB

Look at what plain "lsof" gives you. You get the PID in the second column/field. Then you get the size in the seventh field/column and at the end of the line the indicator "(deleted)". So you could pipe the output of "lsof" into "awk" and get that number and then kill it with "kill" Just be sure to account for the possibility of spaces in file names and paths.

procfs · 06-07-2016, 06:54 AM

Hi Turbocapitalist, thanks for the update, and we came up with below

lsof -a +L1 | awk -F" " '$8 > 1073741824 {print $2}' | sed 's\^\kill -9 \' > /tmp/kill_script

then we run /tmp/kill_script

Thanks and Regards

Turbocapitalist · 06-07-2016, 07:06 AM

Nice. Are you sure that column 8 is the size? On Ubuntu, I have column 7 as the size. Also you can skip the extra step of making a file with "xargs"

Code:

lsof -a +L1 | awk '$7 > 1073741824 && NR >1 {print $2}' | sort -nu | xargs kill

jpollard · 06-07-2016, 08:25 AM

Depending on the process "kill -9" will not allow it to gracefully exit. If other files are open it will lose buffers you just might want to keep. Use -3 instead.

If the process maintains its own log and the process must be restarted, you might try -1 instead. For many daemon services this is a signal to close logs and reopen them, and without losing any active connections.

This is how a log rotate procedure works.

procfs · 06-07-2016, 11:26 PM

Thanks Jpollard!

Thanks all and Best Regards