How to stop a infinite running process (ztail) started by a ssh session after that session is closed

Question

I have a peculiar problem. My server supports multiple ssh session simultaneously, so that multiple admins can manage (via command line interface) it simultaneously. We have a command which calls ztail to show the compressed log files. Now when the current ssh session is closed (without pressing Ctrl-C, to stop the ztail command), this command should ideally stop working. But what I observed when I start a new ssh session that, the process (ztail) is still running in background and consuming my CPU, even though the previous session was closed. Now how can I know when the session was closed, so that I can use that variable/flag to close/stop any commands initiated by that previously closed session?

Answer 1

This only happens if you run ztail (or any other command) as a new root-level process (i.e. without a parent process), e.g. in the background or via cron.

Usually when you start a standard ssh session you get a shell process, which is the root process for all programs you start. If the ssh session terminates, the kernel kills all child processes as well. (That's why people usually use screen or comparable things to retain sessions.)

So the easiest thing for you would be to utilize this default behavior. Have a look at ps axjf to check what ztail's root process is, then figure out why it survives the terminated ssh session.

Answer 2

During the ssh-session a shell-session will be a child process. That child process will have another child process: ztail. After closing the shell ztail will loose its parents. As with all these processes, they will be adoped by init with PID 1.

To if the parent-pid of ztailis 1, it is most probably one of your "zombies".