UNIX for Dummies Questions & Answers

I'm system administrator and most of our Unix servers in the company host database that are accessed frequently by company employees. One day, one particular Unix server has been reported as being very slow. Upon further investigation using the ps command, we've found a rogue process that is wasting a great deal of system resources. Unfortunately, the rogue process is a database maintenance program and should be kiilled with caution.

1) Which kill signal would you send this process and why ?

2) If the rogue process traps this signals, which other kill signals would you try ?

3) Which command could you use as a last resort to kill the rogue process ?

Very much appreciate if you could extend some help as we're not very handy with Unix.

Cheers

do

ps -efXunix to find the process and pid

kill -9 <pid> will kill the process.
here we are sending SIGKILL signal and this is non-ignorable kill.


-kumaran

Hi,

First, always try to use the default signal (15, SIGTERM). This signal will try to terminate the process safely.

If the application is well built, it will answer to the SIGTERM, and terminate... If you're using Solaris, use psig pid and it will show you how the process will behave to each available signal. You can also try signal 2 (SIGHUP), some applications reload their configuration files at this signal...

At last resort, use signal 9 (SIGKILL). It will terminate the application immediatly, but some system resources might not be released.

Dear all,

Many thanks to your posting....welcome more....

SUN has a nice signal primer. See http://developers.sun.com/solaris/ar...alprimer.html.

Cheers,

Keith

kdufin, thar link did not work for me.

Could I ask why is this process a "rogue"? How do you know is it "wasting" system resources? Couldn't it be simply "using" system resources?

You don't give us many details here. There is not a single answer that covers all cases. It would be particularly nice to know which resource or resources had been used by this process.

Since the report was "very slow", I'm going to guess that a several minute delay in fixing the slowness is acceptable. The first thing to do is figure out as much as you can. Do you have database people? Can they help? The UID, PPID, and TTY fields can often be used to figure out who started the program. If nothing else, you might contact the database vendor and ask for advice. One thing you want to know fairly quickly is if a core dump would be both possible and useful. That will influence which signal you will want to send to the program.

Can you be sure that you won't regret killing this process? If the process is simply performing too much I/O or something like that, you may have an interesting option: SIGSTOP. That signal can not be caught or ignored. And it will cause the process to stop executing. This can buy you time for a more permanent solution. And it can be used as a test to see if anything bad happens. If so, you can send a SIGCONT and the process will spring back to life.

If you decide to kill the process, you need to know if you need a coredump. It could be that a coredump would be vitally useful. Or it could be that a coredump would be useless and might even fill a filesystem. If you don't want a coredump, then SIGINTR, SIGTERM, and SIGHUP might be good choices. If you do want a coredump, then SIGQUIT, SIGSEGV, and SIGBUS might work. If one of those trios did not not work, I would fall back to SIGKILL. You can send any signal to a stopped process, no need to continue it first.

My apologies; normally I have the sense to leave a space between a URL and a period. Maybe I can blame my English teacher for ruining my web grammer <grin>. Here's the correct URL:

http://developers.sun.com/solaris/ar...nalprimer.html

Cheers,

Keith