[Nottingham] Unkillable process?

[Richard Bagshaw]

Hiya,

Have you tried kill -9 <pid> or dropping to another runlevel ?

Richard

Johannes Kling wrote:
> Hello,
>
>   On one of our machines two processes have cropped up that appear to
> be completely unkillable; I was wondering if anyone here has come
> across something like this and can suggest something other than a
> reboot to get rid of it.
>
> Some details:
>
> It's RHEL running on an SMP enabled 2.4.21 and a Xeon that's
> pretending to be two processors.
>
> They were launched from a legitimate cron job and, to the best of my
> knowledge, the machine is not compromised. It's a short shell script
> that does a couple of checks and then invokes patch on a file; it's
> run fine before and has been running fine since, so I don't think it's the
> script itself.
>
> "ps" shows them to be in state "R", so they're not in uninterruptible sleep:
> ----
> # ps fax | grep -A1 ^31243
> 31243 ?        R    120409:20 /bin/sh /scripts/checkfpkey
> 31244 ?        RW     0:00  \_ [patch]
> ----
> (Yes, it's been there for a while :-).
>
> I've sent both a TERM, INT and a KILL (several times) but they
> continue to merrily chug along as if nothing's happened. 
>
> "top" claims that the processor the script's running on is working
> flat out on "system" jobs, but an "strace" shows nothing at all (not
> even a pending system call) and just hangs immediately after
> attaching.
>
> The entries in /proc for the script look OK, but the ones for patch
> look quite zombie-esque (all links pointing nowhere); I'd expect to
> see a Z in ps if that was the case, though, so it's confusing me a
> bit.
>
> There's no useful information in dmesg.
>
> Google results for this didn't proove very encouraging; the gist of
> the result was that it's probably it's stuck waiting for he kernel to
> finish and, until that happens, it'll stay.
>
> I'm beginning to think that the machine's just grown fond of the
> process over time and doesn't want to give it up anymore...
>
> Any suggestions would greatly appreciated :-).
>
> Regards,
>   Jo
>
>