Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Basically I need to be able scan the process tree and find processes that match a certain name and started running more than a week a go. Once I have them, I need to kill them. All the processes are still seen as in a running state by the system, just not using any system time. They'll usually sit forever in this state too.

Ideally I'd like something similar to find, but for processes.

System is Debian linux and this will be scripted and run by cron so I've no real issues with something large but understandable.

share|improve this question
3  
how are you going to differentiate between old-but-important processes and ones you're happy to kill? –  Chopper3 Oct 5 '09 at 14:43

5 Answers 5

up vote 4 down vote accepted

YOu can do this with a combination of ps , awk and kill:

ps -eo pid,etime,comm

Gives you a three column output, with the process PID, the elapsed time since the process started, and the command name, without arguments. The elapsed time looks like one of these:

mm:ss
hh:mm:ss
d-hh:mm:ss

Since you want processes that have been running for more than a week, you would look for lines matching that third pattern. You can use awk to filter out the processes by running time and by command name, like this:

ps -eo pid,etime,comm | awk '$2~/^7-/ && $3~/mycommand/ { print $1 }'

which will print the pids of all commands matching 'mycommand' which have been running for more than 7 days. Pipe that list into kill, and you're done:

ps -eo pid,etime,comm | awk '$2~/^7-/ && $3~/mycommand/ { print $1 }' | kill -9
share|improve this answer
    
Nice one thanks. Completely forgot about the formatting options in ps. –  Ryaner Oct 5 '09 at 15:39
1  
This doesn't show you processes running "more than 7 days". It shows you processes running between 7 days but less than 8 days. –  hobodave Sep 15 '10 at 16:49
    
etimes is more handy — serverfault.com/a/393476/67675 –  poige May 30 '12 at 13:31

All the info you need can be grabbed from ps -ef. See the "STIME" column. Combine that with grep to sort out the processes you need. At that point, you can use cut to grab the pid of all the matching processes and pass those to kill.

Please let me know if you'd like more details on how to do this.

share|improve this answer
    
I would like more details. The other answers are simply incorrect. –  hobodave Sep 15 '10 at 16:57

When a process starts up, it creates a directory in the /proc filesystem. You can use the find command to get directories older than 7 days and kill the processes as follows:

find /proc -user myuser -maxdepth 1 -type d -mtime +7 -exec basename {} \; | xargs kill -9
share|improve this answer
    
This doesn't work either. As-is it generates this warning, and no additional output: find: warning: you have specified the -maxdepth option after a non-option argument -user, but options are not positional (-maxdepth affects tests specified before it as well as those specified after it). Please specify options before other arguments. Moving -maxdepth to be the first output it returns no processes, and I am positive that many should match. –  hobodave Sep 15 '10 at 16:55
    
also why mtime not ctime if you're looking for the creation date of the dir? the dir could theoretically be modified if an additional child was created, which I wouldn't rule out (perhaps a newly loaded kernel module would extend sysfs in some way) –  jmtd Feb 6 '13 at 16:05

if you're root, to get rid of trash ( /proc/fs proc/stat ...)

find /proc -maxdepth 1 -regex '/proc/[0-9]*' -type d -mtime +2 -exec basename {} \;
share|improve this answer

Nobody mentioned ps-watcher here. I think you might be able to compare $start_time using the elapsed2sec function but I'm not entirely sure. Here's my first thought:

[myproc]
occurs = every
trigger = elapsed2secs('$start_time') > 7*DAYS
action = <<EOT
  echo "$command has been running more than 7 days" | /bin/mail user\@host
  kill -TERM $pid
EOT

no idea if that works, but it should be a good starting point.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.