Murder and Mayhem - How to kill user's processes

(Updated: this post was rewritten from an older post. That original has generated a lot of comments over the years; please read the whole thing before jumping to add your piece)

It is sometimes necessary to kill all the processes owned by a particular user.

On a modern Linux box or Mac OS X, we'd just do "killall -u username" and be done with it, but that "killall" may not exist on other Unix platforms and if it does exist, it may be an entirely different command with unexpected results.

A common suggestion is something like this:

kill -9 `ps -u <username> -o "pid="`
 

That should work on most Unix variants, though really you shouldn't start off with a -9 and you also need to watch out for variants on how "ps" works.

It all comes down to "a little knowledge is a dangerous thing". If all you know is one variant (like Linux), it can be very dangerous to assume that what you know will work elsewhere. Most of it will, of course, but the Devil is in the details.

Something I should have thought of but did not is to "su username" (if you are root, you don't need their password) and then issue "kill -9 -1" (although again you might want to start with -15 if there are processes that could benefit from a chance to exit gracefully).

The "ps -u" by itself gives you the chance to pick and choose which of the user's processes you want to kill, though. When -j is added ("kill -ju username"), you might be able to pick out a group of processes that can be killed without affecting things you don't want to kill. An example:

$ ps -ju apl | sort -k4 | tail
USER   PID  PPID  PGID   SESS JOBC STAT   TT       TIME COMMAND
apl   3041   220  3041 53a83a8    1 S      ??    0:02.44 /Library/..
apl   3942   220  3942 53a83a8    1 S      ??    0:39.19 /Applications/Text..
apl   4471   291  4471 8696998    1 S+   s000    0:00.00 -bash
apl   4472  4471  4471 8696998    1 S+   s000    0:00.94 ssh xxx@xxxx.com
apl   5472   515  5472 8696ad0    1 S+   s001    0:00.00 -bash
apl   5473  5472  5472 8696ad0    1 S+   s001    0:00.07 ssh xxx@xxxx.com
root  5507   969  5507 8696248    3 R+   s003    0:00.01 ps -ju apl
apl   5508   969  5507 8696248    3 S+   s003    0:00.00 sort -k4
apl   5509   969  5507 8696248    3 S+   s003    0:00.00 tail
 

(I moved the header back to the top to make it easier for you to see it). This listing shows processes belonging to "apl" and sorted by "pgid" - the process group id. If I wanted to kill of everything in 5507, I could do "kill -9 -5507" (note the minus sign in front of 5507) - though in this particular case "kill -9 5507" would do the same thing.

A buggy version of prngd caused an interesing bug on an old SCO system: "prngd killed all processes".

See KTFM (Killing the Fine Manual) and Background tasks - Why? for more interesting things about process groups.

There's plenty of other stuff here about "kill" as it applies to Unix systems.

Note: as your shell may implement kill itself, you want "/bin/kill" if you want your real Unix kill - there can be differences! That "KTFM (Killing the Fine Manual" article also shows some of that. To read about how "bash" implements "kill", do "man builtin" (or "info bulitin") and search for "kill".

21 comments

More Articles by Tony Lawrence - Find me on Google+

Click here to add your comments

---December 29, 2004

kill -9 'ps...'

that is the dumbest thing ive ever heard


---December 29, 2004

Not really. You are probably thinking of "killall" ?
Not all Unixes have that command.

--TonyLawrence





Fri Feb 25 16:26:00 2005: 73   anonymous


I think, the fuser also useful in some same silmilar situation.



Fri Jun 24 20:19:15 2005: 707   anonymous


Works well on Linux! Thanks!



Fri Jun 24 20:56:07 2005: 708   drag


I've had to resort to that sort of thing everyonce in a blue moon. Not pretty, but it works.

You can also use pidof if you know the full path of the proccesses you want to kill. That way it can be used reliably. You can also just use the name of proccess if you want.

Like if your runaway proccess is something like
/usr/local/bin/forkbomb

you can go:
kill -9 `pidof /usr/local/bin/forkbomb`

This is all based on my Linux/Debian experiance, so I don't know about other Unixes.

It's also a symbolic link to /sbin/killall5 on my system, which is the killall on many systemv based systems.

When that is used it doesn't kill a paticular proccess, it kills EVERYTHING except itself and it's or proccesses in it's paticular session. It's used during shutdown/reboot mostly in Linux.








Fri Jun 24 20:58:16 2005: 709   drag


(of course that doesn't check to see what username the paticular proccess is running on.. but I suppose you could do a quick su username to gain that user's privilages to launch the command. Not as nice as the original suggestion, it seems like)



Fri Jun 24 21:16:45 2005: 710   TonyLawrence


On Linux you can "killall forkbomb" - but do NOT try that on SCO : it's an entirely different command.



Tue Jan 20 18:12:46 2009: 5188   pfriedma


su user
kill -9 -1 -1

Will kill all your processes, including the shell you're on/your ssh connection



Tue Jan 20 18:40:19 2009: 5189   TonyLawrence


But we're not talking about you killing your own processes.

By the way, many Unixes and Linux have another option:

if the process number is negative but not -1, the signal is sent to all processes whose process group ID is equal to the absolute value of the process number. This is a variant of killpg(2).









Wed Jan 21 22:37:28 2009: 5220   terrell


works great on AIX



Tue May 19 14:33:55 2009: 6386   AmitVerma


Cut the Crap and execute the command -

killall -u username

It shall kill all the process owned by a username.






Tue May 19 14:37:00 2009: 6387   TonyLawrence


You are showing your ignorance.

First, not all Unixes even have a "killall" command. Worse, on some the command exists but does unpleasant things: it kills ALL processes in preparation for a shutdown.



Tue Dec 22 08:56:38 2009: 7789   FrancoBernazzoli




Under Snow Leopard (Mac OS X) it works using the xargs utility:
ps -u <username> -o "pid=" | xargs kill

Thank you,
Franco



Tue Dec 22 11:49:16 2009: 7792   TonyLawrence




Under Snow Leopard (Mac OS X) it works using the xargs utility:

I can't imagine needing xargs to kill pid's - that would be an incredible number of processes! I suppose typing the pipe to xargs might be easier than typing the backquotes?

OS X has "killall -u username" anyway, so that is the easiest way to do it there.









Fri Sep 17 14:10:24 2010: 8979   sadhna




to kill all d process including login shell:
kill -9 0



Fri Sep 17 14:18:59 2010: 8980   TonyLawrence




No. Again, you need to READ before you comment and you can't assume that what works for you works for everyone!



Tue Sep 28 18:12:28 2010: 9013   anonymous




Yep, 'killall insertanythinghere' in AIX will NOT do what you expect it to do in Linux. Ask me how I know! D'oh!



Mon Apr 4 21:07:30 2011: 9424   anonymous




"But not talking about your processes... "
su username

Kill -9 -1 -1








Mon Apr 18 16:36:24 2011: 9457   TonyLawrence




Yes, that should work (though you got an extra -1 in there and again, you should not start with -9).





Thu Oct 27 14:10:12 2011: 10077   Karin
http://www.energetixdeutschland.de



Nice work. That was exactly what I was looking for. I've got a host running multiple vhosts. As it is, I need to kill a specific user's php interpreter occasionally (script running amok ;-)) without interrupting the other users.
Thank you!



Fri Oct 28 15:00:44 2011: 10087   BigDumbDinosaur
http://bcstechnology.net



As it is, I need to kill a specific user's php interpreter occasionally (script running amok ;-)) without interrupting the other users.

Give that user a smack and tell him/her to fix the script. <Grin>

Don't miss responses! Subscribe to Comments by RSS or by Email

Click here to add your comments

If you want a picture to show with your comment, go get a Gravatar

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.