Linux: How to find the list of daemon processes and zombie processes - linux

I tried checking on Google, but I couldn't find much information related to the actual question.
How do I get a consolidated list of zombie processes and daemon processes?
How do I do it on different operating systems. Linux? AIX? Windows?
I am sure that, based on PID, we cannot identify the type of process. Running through a terminal might not help either.

Try out this.
ps axo pid,ppid,pgrp,tty,tpgid,sess,comm |awk '$2==1' |awk '$1==$3'
In the above command I used the very properties of a daemon to filter them out, from all of existing processes in Linux.
The parent of a daemon is always Init, so check for ppid 1.
The daemon is normally not associated with any terminal, hence we have ‘?’ under tty.
The process-id and process-group-id of a daemon are normally same
The session-id of a daemon is same as it process id.

With GNU ps on Linux:
[
$ ps --version
procps-ng version 3.3.3
]
Zombies:
ps -lA | grep '^. Z'
will get you all zombies (note that the param is lowercase 'L', i.e., 'l' followed by 'A').
Daemons:
As #Barmar said there's no way to get daemons for certain, but a clue that a process is a daemon is that it's not associated with any TTY device. The 12th column of 'ps -Al' output is TTY; the 4th is PID, 14th is the process name. Hence:
ps -lA | awk '$12 == "?" {print $4, $14}'
will get you processes that are possibly daemons; not guaranteed! :)

Daemons are started by the init process, which means they have a PPID of 1.
Therefore:
ps -ef | awk '$3 == 1'

To get the list of Zombie and daemon process just write a psudo character dev driver, where you should navigate trough the task_struct and look for state

I wrote for daemons and the "old" sysv initd, you have to check if it is working on your distro.
Good demons have well written startup scripts in /etc/initd
When changing runlevel, how does init know the running daemons ?
It looks for their names in the directory
/var/lock/subsys
So you can
get the names list from there
scan all the running processes and check if the name is inside the list: bingo !
To scan all the processes: list every subdirectory in
/proc
If its name is digits, it is the pid of a running process.
For example, the status of the process with pid 1234 is this file
/proc/1234/status
Open it and get the first line, starts with "Name:"
See
http://man7.org/linux/man-pages/man5/proc.5.html
https://linuxexplore.com/2014/03/19/use-of-subsystem-lock-files-in-init-script/

Related

How to identify a job given from your user account and kill it

I had given a job in a remote server yesterday from my home. The command was
sh run.sh >& out &
The run.sh will excute a program (average.f) more than 1000 times recurssively.
Today, in my office, I found some mistake in my run.sh. So I would like to kill it.
I used top command, but it is not showing the run.sh. It is only showing average.f. So, once, I killed it with kill PID, it is again starting average.f with another PID and producing outputs.
ps -u is not showing either run.sh or average.f.
Can anybody please help me how to kill this job.
find your job id with the process or application name . example is given below - I am killing java process here
ps -aef|grep java
// the above command will give you pid, now fire below command to kill that job
kill -9 pid
// here pid is a number which you get from the first command
ps -ef | grep run.sh | grep -v grep | awk '{print $2}' | xargs kill -9
Use pstree(1) (probably as pstree -p) to list the process tree hierarchy, then kill(1) (first with -TERM, then with -QUIT, and if that does not work, at last with -KILL) your topmost shell process running run.sh (or else the few "higher" processes). Perhaps use killall(1) or pidof(1) (or pgrep(1) or pkill)
You might want to kill the process group, with a negative pid.
You should never at first kill -KILL a process (but only at last resort); some programs (e.g. database servers, sophisticated numerical computations with application checkpointing, ...) have installed a SIGTERM or SIGQUIT signal handler to clean up their mess and e.g. save some state (on the disk) in a sane way. If you kill -KILL them, they could leave the mess uncleaned (since SIGKILL cannot be caught, see signal(7)....)
BTW, you should use ps auxw to list all processes, read ps(1)

Get PID of a process as it opens

How do I get the pid of a process as soon as it opens. Like lets say we run ./file.pl and then ./file2.pl As both these files will create a pid in /proc/ folder. How do I instantly know if the process has been created when the executable is run.
I have a file with all the commands ready to be run as soon as it gets the green signal that there is a new process in the /proc/ folder. How do I do that?
EDIT:
Please don't answer with a shell command. I don't need to know the pid. I need to develop a script which can know right away that we have a guest in the proc department
If you start the process via a shell, then start process in background:
./your_prog &
Get the pid:
echo $!
If the script give you the shell prompt back, you can do :
./your_prog
pidof -x your_prog
Tested OK with this perl script :
#!/usr/bin/perl
if (fork() == 0) {
sleep(600);
}
you need to
chmod +x your_prog
before...
Every process can get its own pid with the getpid(2) syscall. At process creation by fork(2) the parent process (e.g. some shell) gets the pid of the new child process. Read e.g. Advanced Linux Programming for more. And the kernel (not the program) is creating some subdirectory /proc/1234/ see proc(5) as soon as it creates the process of pid 1234.
Actually, /proc/ is not a real file system. It is just a pseudo file system giving a view on the state of the kernel and the entire Linux system.
Perl gives you its POSIX module to interface the syscalls. The getpid() syscall is interfaced using the $PID or $$ Perl variable.
The /proc/ pseudo filesystem is filled by the kernel. You could perhaps use inotify to follow change in /proc/ but this is very probably a bad idea.
Your question is not clear, we cannot understand what you really want to do and what you have tried.
Try out below shell script.(You may have to include changes in below script for your expected output)
#!/bin/bash
nr_proc_before=`ls -l /proc | wc -l`
ls /proc > proc_list_before
./any_executable &
nr_proc_after=`ls -l /proc | wc -l`
ls /proc > proc_list_after
nr_new=`expr $nr_proc_after - $nr_proc_before`
echo "$nr_new processes are created newly"
echo "new processes pids are :"
diff proc_list_after proc_list_before > new_pids
sed "1d" new_pids
if [ nr_new > 0 ] ; then
#trigger your file which has commands.
fi
Insted of any_execuatble you can replace with your things so that new processes will be created.
Note : This is not a script which monitors for new process. This sample of script may give you idea to solve your problem.
Please do reply for this answer, i can redefine my answer.

Listing completed processes in Unix

I have a PID,but the process is not running anymore and has completed. I need to get the complete details associated with that PID.
Is it possible?
I am using Solaris 5.1 OS.
If the process is a zombie, then you can find it by
ps -ef |grep -i defunct
Otherwise(if the process isn't a zombie) there is no way to retrive the information

pkill kills sshd process started by other user in parent shell

I have a script that runs from a newly created shell.
OS is Red Hat Enterprise Linux Server release 5.4 (Tikanga).
In certain point when the script detects that some application (started by the script) is hanging the script tries to terminate all the procesess it started. I assumed that the correct command for terminating all processes started by current user in current shell is:
pkill /?
The problem is that it kills sshd that is started in parent shell (by init.d) and the putty console disconnects showing error message.
I wonder:
How is it possible for specific user in specific shell to terminate process started by other user in parent shell?
What would be correct command to terminate all processes started by the script currently running?
I have found some solution where i store all the PIDs and when the script needs to terminate them I run in the loop the following:
[ws#RHDev ~]# pkill $(ps aux | grep $pid | awk '{print $2}')
However, I am looking for one-liner that simply terminates all the processes started by the current script.
You can filter subprocesses by the current process pid. The ps command can do this using the --ppid parameter.
ps opid --ppid=7051 | tail -n +2 | xargs kill
here tail -n +2 is to strip the ps headers.
I assumed that the correct command for terminating all processes started by current user in current shell is:
pkill /?
This command matches every single process in the system because it effectively requires only 0 symbols from process name to match. pgrep -l /? demonstrates that.
How is it possible for specific user in specific shell to terminate process started by other user in parent shell?
From man kill(2):
For a process to have permission to send a signal it must either be
privileged (under Linux: have the CAP_KILL capability), or the real or
effective user ID of the sending process must equal the real or saved
set-user-ID of the target process. In the case of SIGCONT it suffices
when the sending and receiving processes belong to the same session.
Do you invoke pkill from user root?
What would be correct command to terminate all processes started by the script currently running?
When bash starts it creates its own process group. Child processes it creates are put in the same process group. Hence:
kill -- -$$
Kills all processes started by the current script. Provided that those processes didn't become group leaders.

How can I monitor the thread count of a process on linux?

I would like to monitor the number of threads used by a specific process on Linux.
Is there an easy way to get this information without impacting the performance of the process?
try
ps huH p <PID_OF_U_PROCESS> | wc -l
or htop
To get the number of threads for a given pid:
$ ps -o nlwp <pid>
Where nlwp stands for Number of Light Weight Processes (threads). Thus ps aliases nlwp to thcount, which means that
$ ps -o thcount <pid>
does also work.
If you want to monitor the thread count, simply use watch:
$ watch ps -o thcount <pid>
To get the sum of all threads running in the system:
$ ps -eo nlwp | tail -n +2 | awk '{ num_threads += $1 } END { print num_threads }'
Each thread in a process creates a directory under /proc/<pid>/task. Count the number of directories, and you have the number of threads.
cat /proc/<PROCESS_PID>/status | grep Threads
ps -eLf on the shell shall give you a list of all the threads and processes currently running on the system.
Or, you can run top command then hit 'H' to toggle thread listings.
$ ps H p pid-id
H - Lists all the individual threads in a process
or
$cat /proc/pid-id/status
pid-id is the Process ID
eg.. (Truncated the below output)
root#abc:~# cat /proc/8443/status
Name: abcdd
State: S (sleeping)
Tgid: 8443
VmSwap: 0 kB
Threads: 4
SigQ: 0/256556
SigPnd: 0000000000000000
If you use:
ps uH p <PID_OF_U_PROCESS> | wc -l
You have to subtract 1 to the result, as one of the lines "wc" is counting is the headers of the "ps" command.
My answer is more gui, but still within terminal. Htop may be used with a bit of setup.
Start htop.
Enter setup menu by pressing F2.
From leftmost column choose "Columns"
From rightmost column choose the column to be added to main monitoring output, "NLWP" is what you are looking for.
Press F10.
JStack is quite inexpensive - one option would be to pipe the output through grep to find active threads and then pipe through wc -l.
More graphically is JConsole, which displays the thread count for a given process.
Here is one command that displays the number of threads of a given process :
ps -L -o pid= -p <pid> | wc -l
Unlike the other ps based answers, there is here no need to substract 1 from its output as there is no ps header line thanks to the -o pid=option.
Newer JDK distributions ship with JConsole and VisualVM. Both are fantastic tools for getting the dirty details from a running Java process. If you have to do this programmatically, investigate JMX.
If you're looking for thread count for multiple processes, the other answers won't work well for you, since you won't see the process names or PIDs, which makes them rather useless. Use this instead:
ps -o pid,nlwp,args -p <pid_1> <pid_2> ... <pid_N>
In order to watch the changes live, just add watch:
watch ps -o pid,nlwp,args -p <pid_1> <pid_2> ... <pid_N>
jvmtop can show the current jvm thread count beside other metrics.
The easiest way is using "htop". You can install "htop" (a fancier version of top) which will show you all your cores, process and memory usage.
Press "Shift+H" to show all process or press again to hide it.
Press "F4" key to search your process name.
Installing on Ubuntu or Debian:
sudo apt-get install htop
Installing on Redhat or CentOS:
yum install htop
dnf install htop [On Fedora 22+ releases]
If you want to compile "htop" from source code, you will find it here.
If you are trying to find out the number of threads using cpu for a given pid I would use:
top -bc -H -n2 -p <pid> | awk '{if ($9 != "0.0" && $1 ~ /^[0-9]+$/) print $1 }' | sort -u | wc -l
If you want the number of threads per user in a linux system then you should use:
ps -eLf | grep <USER> | awk '{ num += $6 } END { print num }'
where as <USER> use the desired user name.
If you're interested in those threads which are really active -- as in doing something (not blocked, not timed_waiting, not reporting "thread running" but really waiting for a stream to give data) as opposed to sitting around idle but live -- then you might be interested in jstack-active.
This simple bash script runs jstack then filters out all the threads which by heuristics seem to be idling, showing you stack traces for those threads which are actually consuming CPU cycles.
First get the process ID (pid) by executing below command:
ps -ef | grep (for e.g ps -ef | grep java)
Now replace the pid in below command and execute to get the total thread count of a process.
ps huH p | wc -l
VisualVM can show clear states of threads of a given JVM process

Resources