Shell Programming and Scripting

server: old MPRAS (NCR corporation)

Process : COnnect direct script ( sending one file)

Unable to kill since the process kicked off again

it should not be a big problem, at least you are the root user!!!!

Before you system gets hanged, you have,at your disposal, some time to type a few of the commands.

Do as follows:

Code:

ps -aef > ps.log;
killall -9 <process_name> ;

Now,

Code:

cat ps.log

See the output and find that the ppid is also shown for each pid. Start from the tail of the output and try to find the great grand father of that process; beware it should not end with having initd (pid == 1) as their great grand father if yes your task has been compounded a few extra miles.

If initd is not seen as the forefather of the lot, issue the command :

Code:

runlevel

This tells your default runlevel and would output a number (most likely 3 or maybe 5 if you had installed you system with all the default settings), say N.

Use now,

Code:

cat /etc/rc.d/rcN

Now just remove all the references/enteries (or any softlinks but don't forget to notice the actual path of the link on your disk, if it is so) as below:

Code:

rm -rf  *<process_name>*

Do a similar treatment to actual path noticed, if that was a link (and the same is not available under /etc/init.d

Use of chkconfig might not be reliable as if that's malicious code; so directly remove as described above.

Now comming to the case of initd being the parent to all the process group

Simply add the extra step in determing what was the initiating process

Code:

mkdir -p /tmp/my_rcN;
cp /etc/rc/rcN.d;

Now start copying back all the enteries one by one but make sure that once you copy an entery starting with 'S' then must copy its coressponding entery starting with 'K'.
With each copy you through the command:

Code:

init N;

See which copy back creates the problem again; that the culprit executable ; you now simply have to delete and copy back all the other enteries to /etc/rc/rcN.d folder.

Your distribution also might show your rcN.d folder immediately under /etc/ in this case you need to use /etc/rcN.d instead of /etc/rc/rcN.d

Please let me know if this resolved your problem out.

Thanks.