I need to kill the processes older then then one day

deepak_message · 05-27-2012, 04:05 AM

I need to kill the processes in redhat which are older then one day for the user only Not for the system processess.

Actually, I need to kill the process for the user who have taken session for last one day.

Script will show the list first then aks to kill (yes/No)

Can you please help, who have the good scripting skill.

Please help

robertjinx · 05-27-2012, 11:49 AM

You can start something like this:

Code:

for proc in $(find /proc -maxdepth 1 -type d -name "[0-9]*" -mmin +1440); do 
   pid=$(basename ${proc})
   user=$(stat -c %U ${proc})
   if [ "${user}" = "root" ]; then
      continue
   else
      kill ${pid}
   fi
done

With this you can find all processes which are one or more days older and then you can check if they belong or not to use root, if they don't you can kill them.

And using this little idea you can do whatever you want or need.

robertjinx · 05-27-2012, 04:03 PM

Actually this script is not a totally good idea, coz it will kill all processes which are not started with root user, and in most cases there will be some processes running with different user then root which you shouldn't kill.

Code:

for proc in $(find /proc -maxdepth 1 -type d -name "[0-9]*" -mmin +1440); do 
   pid=$(basename ${proc})
   uid=$(stat -c %u ${proc})
   if [ ${user} -qe 500 ]; then
      kill ${pid}
   fi
done

So this new example will kill all processes which belong to users with a id bigger or equal to 500, which shouldn't be any "special" system user.

unSpawn · 05-27-2012, 06:52 PM

Use ALL-CAPS variable names for readability, use "while" loop instead, speed up by excluding root-owned processes, speed up by avoiding basename and stat, derive value of 500 from /etc/login.defs, check shell, it's not "-qe" but "-ge" BTW and allow process to end before killing it:

Code:

_MIN_UID=$(awk '/UID_MIN/ {print $2}' /etc/login.defs); _UID_LIST=$(awk -F: '{ if ($7 == "/bin/bash" && $3 >= 500 ) { print $3}}' /etc/passwd)
find /proc -maxdepth 1 -type d -name "[0-9]*" -mmin +1440 -not -uid 0 -printf "%f %U\n" | while read _PID _UID; do
 LIST=${#_UID_LIST}; CHECK=${_UID_LIST//${_UID}/}; CHECK=${#CHECK}; [ ${_UID} -ge ${_UID_MIN:=500} -a "${LIST}" -ne "${CHECK}" ] \
&& { kill -15 ${_PID}; sleep 3s; kill -9 ${_PID}; }; done

robertjinx · 05-28-2012, 02:10 AM

Yep, it's a typo there:

Code:

${user} -qe 500

suppose to be:

Code:

${user} -ge 500

deepak_message · 05-28-2012, 03:30 AM

Really, you guys are coder... Thank you so much to all of you..

But I have one more request please ... if you can help that would be helpful fro me...

I have required another script, which will kill only more then one hour old for specific sshd process for all of the user including root also

Suppose, I need to kill only sshd process, which has time got over more then an hour to all of the user inculding root also.

Nominal Animal · 05-28-2012, 03:59 AM

It would be better to start a new thread for a new question, but I guess this is just an extension.

First, use

Code:

LANG=C LC_ALL=C ps -o pid= -o etime= -o cmd= -C sshd

to obtain the PID, elapsed time (age), and command line for each SSH process. The elapsed time is MM:SS if less than a hour, HH:MM:SS if less than a day, and DD-HH:MM:SS if a full day or longer.

Then, you need to ignore the process which matches command /usr/sbin/sshd, because that is the listening server, not an SSH connection. You also need to ignore the processes that have not run long enough yet, and send a termination signal (TERM or KILL) to the processes that have run long enough.

Once again, I'd use awk for this. Using awk in a Bash script:

Code:

export LC_ALL=C
export LANG=C

PIDS=$(ps -o pid= -o etime= -o cmd= -C sshd | awk '#
    # Remove leading whitespace if necessary.
    ($1 ~ /^[\t\v\f ]*$/) {
        sub(/^[\t\v\f ]*/, "", $0)
    }

    # Skip the listening SSH server process.
    ($3 == "/usr/sbin/sshd") { next }

    # Parse the time.
    {
        # To calculate the elapsed time in seconds, split it into fields.
        timetemp = $2
        gsub(/[^0-9]+/, " ", timetemp)
        n = split(timetemp, timepart)

        # Compute the number of seconds based on n fields in timepart.
        if (n >= 4)
            time = timepart[4] + 60*timepart[3] + 60*60*timepart[2] + 24*60*60*timepart[1]
        else if (n == 3)
            time = timepart[3] + 60*timepart[2] + 60*60*timepart[1]
        else
            time = timepart[2] + 60*timepart[1]

        # Ignore if less than a hour, 3600 seconds.
        if (time < 3600)
            next

        # print the PID.
        print $1
    }')

# Kill the processes that are old enough.
[ -n "$PIDS" ] && kill -KILL $PIDS

Note that AIX ps might use different flags. Also, I have not tested the code, so there might be typos or bugs lurking in there; you need to carefully check it first.