Murder and Mayhem - How to kill user's processes

(Updated: this post was rewritten from an older post. That original has generated a lot of comments over the years; please read the whole thing before jumping to add your piece)

It is sometimes necessary to kill all the processes owned by a particular user.

On a modern Linux box or Mac OS X, we'd just do "killall -u username" and be done with it, but that "killall" may not exist on other Unix platforms and if it does exist, it may be an entirely different command with unexpected results.

A common suggestion is something like this:


kill -9 `ps -u <username> -o "pid="`
 

That should work on most Unix variants, though really you shouldn't start off with a -9 and you also need to watch out for variants on how "ps" works.

It all comes down to "a little knowledge is a dangerous thing". If all you know is one variant (like Linux), it can be very dangerous to assume that what you know will work elsewhere. Most of it will, of course, but the Devil is in the details.

Something I should have thought of but did not is to "su username" (if you are root, you don't need their password) and then issue "kill -9 -1" (although again you might want to start with -15 if there are processes that could benefit from a chance to exit gracefully).

The "ps -u" by itself gives you the chance to pick and choose which of the user's processes you want to kill, though. When -j is added ("kill -ju username"), you might be able to pick out a group of processes that can be killed without affecting things you don't want to kill. An example:

$ ps -ju apl | sort -k4 | tail
USER   PID  PPID  PGID   SESS JOBC STAT   TT       TIME COMMAND
apl   3041   220  3041 53a83a8    1 S      ??    0:02.44 /Library/..
apl   3942   220  3942 53a83a8    1 S      ??    0:39.19 /Applications/Text..
apl   4471   291  4471 8696998    1 S+   s000    0:00.00 -bash
apl   4472  4471  4471 8696998    1 S+   s000    0:00.94 ssh [email protected]
apl   5472   515  5472 8696ad0    1 S+   s001    0:00.00 -bash
apl   5473  5472  5472 8696ad0    1 S+   s001    0:00.07 ssh [email protected]
root  5507   969  5507 8696248    3 R+   s003    0:00.01 ps -ju apl
apl   5508   969  5507 8696248    3 S+   s003    0:00.00 sort -k4
apl   5509   969  5507 8696248    3 S+   s003    0:00.00 tail
 

(I moved the header back to the top to make it easier for you to see it). This listing shows processes belonging to "apl" and sorted by "pgid" - the process group id. If I wanted to kill of everything in 5507, I could do "kill -9 -5507" (note the minus sign in front of 5507) - though in this particular case "kill -9 5507" would do the same thing.

A buggy version of prngd caused an interesing bug on an old SCO system: "Dying processes (inetd, cron, syslogd, sshd)".

See KTFM (Killing the Fine Manual) and Background tasks - Why? for more interesting things about process groups.

There's plenty of other stuff here about "kill" as it applies to Unix systems.

Note: as your shell may implement kill itself, you want "/bin/kill" if you want your real Unix kill - there can be differences! That "KTFM (Killing the Fine Manual" article also shows some of that. To read about how "bash" implements "kill", do "man builtin" (or "info bulitin") and search for "kill".



Got something to add? Send me email.





(OLDER) <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> -> Murder and mayhem - How to kill user's processes on Unix

21 comments



Increase ad revenue 50-250% with Ezoic


More Articles by

Find me on Google+

© Tony Lawrence




---December 29, 2004

kill -9 'ps...'

that is the dumbest thing ive ever heard


---December 29, 2004

Not really. You are probably thinking of "killall" ?
Not all Unixes have that command.

--TonyLawrence





Fri Feb 25 16:26:00 2005: 73   anonymous


I think, the fuser also useful in some same silmilar situation.



Fri Jun 24 20:19:15 2005: 707   anonymous


Works well on Linux! Thanks!



Fri Jun 24 20:56:07 2005: 708   drag


I've had to resort to that sort of thing everyonce in a blue moon. Not pretty, but it works.

You can also use pidof if you know the full path of the proccesses you want to kill. That way it can be used reliably. You can also just use the name of proccess if you want.

Like if your runaway proccess is something like
/usr/local/bin/forkbomb

you can go:
kill -9 `pidof /usr/local/bin/forkbomb`

This is all based on my Linux/Debian experiance, so I don't know about other Unixes.

It's also a symbolic link to /sbin/killall5 on my system, which is the killall on many systemv based systems.

When that is used it doesn't kill a paticular proccess, it kills EVERYTHING except itself and it's or proccesses in it's paticular session. It's used during shutdown/reboot mostly in Linux.








Fri Jun 24 20:58:16 2005: 709   drag


(of course that doesn't check to see what username the paticular proccess is running on.. but I suppose you could do a quick su username to gain that user's privilages to launch the command. Not as nice as the original suggestion, it seems like)



Fri Jun 24 21:16:45 2005: 710   TonyLawrence

gravatar
On Linux you can "killall forkbomb" - but do NOT try that on SCO : it's an entirely different command.



Tue Jan 20 18:12:46 2009: 5188   pfriedma

gravatar
su user
kill -9 -1 -1

Will kill all your processes, including the shell you're on/your ssh connection



Tue Jan 20 18:40:19 2009: 5189   TonyLawrence

gravatar
But we're not talking about you killing your own processes.

By the way, many Unixes and Linux have another option:

if the process number is negative but not -1, the signal is sent to all processes whose process group ID is equal to the absolute value of the process number. This is a variant of killpg(2).









Wed Jan 21 22:37:28 2009: 5220   terrell

gravatar
works great on AIX



Tue May 19 14:33:55 2009: 6386   AmitVerma

gravatar
Cut the Crap and execute the command -

killall -u username

It shall kill all the process owned by a username.






Tue May 19 14:37:00 2009: 6387   TonyLawrence

gravatar
You are showing your ignorance.

First, not all Unixes even have a "killall" command. Worse, on some the command exists but does unpleasant things: it kills ALL processes in preparation for a shutdown.



Tue Dec 22 08:56:38 2009: 7789   FrancoBernazzoli

gravatar


Under Snow Leopard (Mac OS X) it works using the xargs utility:
ps -u <username> -o "pid=" | xargs kill

Thank you,
Franco



Tue Dec 22 11:49:16 2009: 7792   TonyLawrence

gravatar


Under Snow Leopard (Mac OS X) it works using the xargs utility:

I can't imagine needing xargs to kill pid's - that would be an incredible number of processes! I suppose typing the pipe to xargs might be easier than typing the backquotes?

OS X has "killall -u username" anyway, so that is the easiest way to do it there.









Fri Sep 17 14:10:24 2010: 8979   sadhna

gravatar


to kill all d process including login shell:
kill -9 0



Fri Sep 17 14:18:59 2010: 8980   TonyLawrence

gravatar


No. Again, you need to READ before you comment and you can't assume that what works for you works for everyone!



Tue Sep 28 18:12:28 2010: 9013   anonymous

gravatar


Yep, 'killall insertanythinghere' in AIX will NOT do what you expect it to do in Linux. Ask me how I know! D'oh!



Mon Apr 4 21:07:30 2011: 9424   anonymous

gravatar


"But not talking about your processes... "
su username

Kill -9 -1 -1








Mon Apr 18 16:36:24 2011: 9457   TonyLawrence

gravatar


Yes, that should work (though you got an extra -1 in there and again, you should not start with -9).





Thu Oct 27 14:10:12 2011: 10077   Karin

gravatar


Nice work. That was exactly what I was looking for. I've got a host running multiple vhosts. As it is, I need to kill a specific user's php interpreter occasionally (script running amok ;-)) without interrupting the other users.
Thank you!



Fri Oct 28 15:00:44 2011: 10087   BigDumbDinosaur

gravatar


As it is, I need to kill a specific user's php interpreter occasionally (script running amok ;-)) without interrupting the other users.

Give that user a smack and tell him/her to fix the script. <Grin>

------------------------
Kerio Samepage


Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

privacy policy