Hi Leonard, I am not sure exactly how your user logged out, if he/she typed 'exit' on the terminal emulator window or whether he/she just clicked the 'X' button ;) Logging out properly with 'exit' should take care of all of the user's processes, unless he or she ran a program in the background that is looping or in a defunct state. A 'ps -elf | grep Z' should show you such processes. If your 'ps -u [username]' simply showed the header line "PID TTY TIME CMD, etc", then that means that as far as the system is concerned, no processes exist that are directly owned by the user. Note that the 'ps' command reads the kernel process table, whereas 'who' reads the 'wtmp' and 'utmp' databases which contain login information. (Look in /var/run and /var/log). This is why you picked up a discrepancy. That user could have spawned other processes that did not terminate when the user's parent processes did. These are sometimes called 'orphaned processes'. This *could* result in the 'finger' showing you what it did, i.e. a process attached to a terminal that has been idle for 287 days (287d). A little digression - there is a daemon process called 'init', which runs on UNIX-type systems, which is meant to inherit these orphaned processes, and terminate them. However, this only happens if the process is running. If a process is defunct, the only way to clear them is to reboot the system, which you did. A defunct process is a process that is still occupying a slot in the process table, but is not actually running. As such, the 'kill' command won't work because there is nothing to 'kill'. One of the list members suggested that you use 'kill -9 [PID]'. I say that you should not be too liberal with using the -9 option. Kill -9 cannot be trapped or ignored by any process, and does NOT allow the process being killed to do proper "house cleaning" and allow that process to wait/terminate all of it's children first. A normal "kill [PID]" (Defaults to kill -15) sends a 'SIGTERM' to the process, which is a software termination signal that is a lot safer to use than kill -9, which you should only use as a last resort. Many administrators use kill -9 all the time, and this is NOT a good practice, and can result in many orphaned processes still running or sleeping on the system, particularly if these processes are waiting for a specific response from their parents. I hope this has helped you! Jason On Thu, 2003-10-16 at 01:36, Leonard Miller wrote: > Thanks for the help. Nothing I tried worked so I just rebooted the > server. ps -ef didn't show any processes for the user. "who" showed > the login date as Oct 13 but there were no processes with that date. So > I just kicked it in the head. > > Thanks again > Leonard > > Automatically inserted lawyer supplied blurb follows. > > >>> chris@xxxxxxxxxxx 10/15/03 14:15 PM >>> > if you type "ps -ef" you will see all the processes running from all > users. > If your user is still logged on, look for the shell process id, then you > can use "kill -9 PID" to kill that process. > > ps -ef > > root 20546 1330 0 10:40 ? 00:00:00 [sshd] > user 20547 20546 0 10:40 pts/0 00:00:00 -bash > > kill -9 20546 > > > > **********CONFIDENTIALITY NOTICE********** > The information contained in this e-mail may be confidential and/or > privileged and is intended for the sole use of the individual or > organization named above. If you are not the intended recipient or an > authorized representative of the intended recipient, any review, copying > or distribution of this e-mail and its attachments, if any, is prohibited. > If you have received this e-mail in error, please notify the sender > immediately by return e-mail and delete this message from your system. -- Psyche-list mailing list Psyche-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/psyche-list
