2

I did something stupid and ran an awk that runs a while loop that sends an email every 10 seconds. I ran this as a background process:

egrep '^[1-9]' /etc/hosts | grep -v 'localhost' | awk '{ system("ssh "$1" \42\while (true); do uptime > /home/dan/test.txt; grep \x60\hostname\x60 /etc/hosts >> /home/dan/test.txt; echo >> /home/dan/test.txt; echo >> /home/dan/test.txt; /home/dan/myscript.pl | grep FAIL -A1 >> /home/dan/test.txt;echo >>/home/dan/test.txt; if [[ $(grep FAIL /home/dan/test.txt) != \x22\x22 ]]; then  sendmail jddancks@domain.net < /home/dan/test.txt; fi;sleep 10; done\42 &"); print "" }'

I realized I did something wrong, as a bunch of email are coming in, but I thought I could simply stop it if I simply close the shell. That didn't work. I tried doing other awks that run ps-efw and grep for keywords in that command, in case in might be running and then running a kill -9 on it. Nothing show ups. I checked while,dan,sendmail,myscript.pl:

egrep '^[1-9]' /etc/hosts | grep -v 'localhost' |  awk '{ system("ssh "$1" \42 ps -efw | grep sendmail\42");}'

I think my next bet is to check for processes sending mail on these boxes, and then killing or blocking it. I'm not sure how I can do this since nothing in ps aux shows up.

4

The scripts will most often be doing 'sleep 10'. Start by putting them into the stopped state:

pkill -ef --signal STOP 'sleep 10'

This will block the while loop. The use ps -ef or similar to find the parent id of the sleep (PPID column) and kill that process and the sleep. The parent process will be your shell, eg bash, which is implementing the while command which you cannot find.

You can kill the parent with a hangup signal after finding its parent using ps on the process id found by pgrep:

kill -hup $(ps -h -o ppid $(pgrep -f 'sleep 10'))
  • 1
    on an alternate way, you can use ps -H to locate sleep 10 process, then manually (and quickly) kill parent and grand parent process. – Archemar Mar 13 '16 at 7:42
  • 1
    @Archemar He would need to do ps -H in the same terminal session, which I don't think he can, but you are right, something like ps fa will list a nice hierarchy showing what the parent of the sleep is. I was imagining he might want to write a script to get the PPID and do the kill, depending on how many remote machines he is running this on! – meuh Mar 13 '16 at 7:48
  • 1
    there are also ps -H -f pts/XX or ps -H -u $LOGNAME which will do nicely. – Archemar Mar 13 '16 at 7:52
  • Well, I finally figured it out, these commands were very helpful. For some reason I had better luck grepping for other keywords in the script. So what happened was, the reason it was firing emails is because I got the quoting wrong and the command had [[ != ]] as its if statement lol. But also that 1) the script in its entirety was a process. It wasn't broken off or forked, threaded,etc 2) using & in the awk system() command plus the command passed to SSH made the script a child of init.d, like it was forked So I killed the awk shell but not the forked ssh processes. interesting – jason dancks Mar 13 '16 at 21:06
  • like a daemon process. – jason dancks Mar 13 '16 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.