How to identify & kill runaway processes that runs, exits, then runs again?

Question

Question

How can I identify a program caught in an endless loop; where it runs, dies, then runs again? How can I kill it and prevent it from starting again - is reinstalling the package the only way?

Background

I've just removed the sos package from a CentOS 6.7 machine in order to stop it running sosreport as root around once every minute, which was tying up major resources and slowing down the server. When I tried to kill the PID, it simply popped up again using a different one. It seemed to exit by itself, but would then run again almost immediately.

This indicates that the process is not a 'zombie' by the normal definition, as it both exits by itself then pops up again as a new process.

I checked crontab for an entry that runs it, and could not find one, and I am not sure how to check for this kind of problem. Eventually, reinstalling the package seemed to fix the issue in this case.

Bonus question

Is this behaviour indicative of a wider problem?

Answer 1

Did you use yum to uninstall it?

I would check for any startup/upstart/init.d scripts that might be lingering around.

As a last resort, if there are no startup scripts, you can try moving it to the /tmp/ directory:

sudo mv `which sosreport` /tmp/