A process occupies a lot of CPU, and when I kill it by kill -9, it just re-runs with another name.  How can I find it out, kill and delete it?.  Its parent pid is 1, started by root user, and on the directory of /usr/bin with a random hex name like 3b62ba238f. And when I try to kill it, it just re runs with another new name/command. For example, if I kill the process 15459 in the first picture, another process starts to run with a new name/command.  The both occupy a lot of CPU and with the parent id of 1. The syslog prints the following when the new process starts  How can I find, shut down and delete the process/file? The malware was found following the steps below.  Find the service corresponding to the process.  systemctl status &lt;PID&gt;   Locate the service file, stop and remove the service. Then delete the files. systemctl stop pmapx_start_2 systemctl disable pmapx_start_2 rm -f /etc/systemd/system/multi-user.target.wants/pmapx_start_2.service rm -f /usr/sbin/route_forbidden-close
63049
I found malware on my ec2 instance which was continuously mining bitcoin and using my instance processing power. I successfully identified the process, but was unable to remove and kill it.  I ran this command  watch "ps aux | sort -nrk 3,3 | head -n 5"  It shows the top five process running on my instance, from which I found there is a process name 'bashd' which was consuming 30% of cpu.  The process is   bashd -a cryptonight -o stratum+tcp://get.bi-chi.com:3333 -u 47EAoaBc5TWDZKVaAYvQ7Y4ZfoJMFathAR882gabJ43wHEfxEp81vfJ3J3j6FQGJxJNQTAwvmJYS2Ei8dbkKcwfPFst8FhG -p x   I killed this process by using the kill -9 process_id command. After 5 seconds, the process started again.
44082
I am always very hesitant to run kill -9, but I see other admins do it almost routinely.  I figure there is probably a sensible middle ground, so:   When and why should kill -9 be used? When and why not? What should be tried before doing it? What kind of debugging a "hung" process could cause further problems?
17306
How are these fundamentally different &quot;things&quot; on Windows? Aren't all running things Processes? It seems that every Application has an associated process that shuts it down if it is shut down. It looks like one process can manage more than one application instance. And Services, I'm not even sure what they are, exactly. Are they not processes themselves?
53028
I'm attempting to limit a process to a given number of CPU cores. According to the taskset man page and , the following should work:  [fedora@dfarrell-opendaylight-cbench-devel ~]$ taskset -pc 0 &lt;PID&gt; pid 24395's current affinity list: 0-3 pid 24395's new affinity list: 0   To put it simply - this doesn't work. Putting the process under load and watching top, it sits around 350% CPU usage (same as without taskset). It should max out at 100%.  I can properly set affinity via taskset -c 0 &lt;cmd to start process&gt; at process spawn time. Using cpulimit -p &lt;PID&gt; -l 99 also . In both cases, putting the process under the same load results in it maxing out at 100% CPU usage.  What's going wrong here?
32899
I want to start a programm with timeout, how can I kill the process using SIGINT and SIGKILL? If the programm not terminate within 5 seconds, send SIGINT. If it’s still running after 10 seconds (in total), send SIGKILL.  I already did timeout -s SIGINT nano; timeout -s SIGKILL nano but its not working, can somebody help me?
47434
Is there any command in Linux to figure out, given a process, which processor the process is running? I am interested in figuring out the CPU busy and CPU idle time of that processor.
60934
How can I grep the PS output with the headers in place?  These two process make up an app running on my server....  root     17123 16727  0 16:25 pts/6    00:00:00 grep GMC root     32017     1 83 May03 ?        6-22:01:17 /scripts/GMC/PNetT-5.1-SP1/PNetTNetServer.bin -tempdir /usr/local/GMC/PNetT-5.1-SP1/tmpData -D   does 6-22:01:17 mean that it's been running for 6 days?  I'm tring to determine the length of how long the process has been running...  Is the 2nd column the process id?  So if I do kill 32017 it'll kill the 2nd process?
69550
I'm trying to find a way to get my own PID from a command prompt (for later use in bat scripts).  So far the only useful way I found was to use getpids.exe from here : , but I'm looking for a command that's "built in" to Windows.  I'm looking for a "bullet proof" way. No assumptions about my process being the only cmd.exe or anything.
1970
I have been studying the Linux kernel behaviour for quite some time now, and it's always been clear to me that:     When a process dies, all its children are given back to the init process (PID 1) until they eventually die.   However, recently, someone with much more experience than me with the kernel told me that:     When a process exits, all its children also die (unless you use NOHUP in which case they get back to init).   Now, even though I don't believe this, I still wrote a simple program to make sure of it. I know I should not rely on time (sleep) for tests since it all depends on process scheduling, yet for this simple case, I think that's fairly enough.  int main(void){     printf("Father process spawned (%d).\n", getpid());     sleep(5);      if(fork() == 0){         printf("Child process spawned (%d =&gt; %d).\n", getppid(), getpid());         sleep(15);         printf("Child process exiting (%d =&gt; %d).\n", getppid(), getpid());         exit(0);     }      sleep(5);     printf(stdout, "Father process exiting (%d).\n", getpid());     return EXIT_SUCCESS; }   Here is the program's output, with the associated ps result every time printf talks:  $ ./test &amp; Father process spawned (435).  $ ps -ef | grep test myuser    435    392   tty1    ./test  Child process spawned (435 =&gt; 436).  $ ps -ef | grep test myuser    435    392   tty1    ./test myuser    436    435   tty1    ./test  Father process exiting (435).  $ ps -ef | grep test myuser    436    1     tty1    ./test  Child process exiting (436).   Now, as you can see, this behaves quite as I would have expected it to. The orphan process (436) is given back to init (1) until it dies.  However, is there any UNIX-based system on which this behaviour does not apply by default? Is there any system on which the death of a process immediately triggers the death of all its children?
34317
Can root kill init process (the process with pid 1)? What would be its consequences?
109329
I use ps aux | grep -i apt to find the process and get: antonio  19070  0.0  0.0  14424  1096 pts/0    S+   07:41   0:00 grep --color=auto -i apt  Commands such as sudo kill -9 14424 or any other number (it has changed over the last 12 hours) all give me a return of &quot;no such process.&quot;
27306
When ever I need to kill a background process I do ps -e | grep &lt;process_name&gt;  Which prints something like this 1766 ? 00:00:13 conky , Then I use the process ID to kill it like so kill 1766 .   Is there any way I can simplify this ? Make it quicker ? reduce the amount of typing ?
116852
I use Bash as my interactive shell and I was wondering if there was an easy way to get Bash to run a system command instead of a shell builtin command in the case where they both share the same name.  For example, use the system kill (from util-linux) to print the process id (pid) of the named process(es) instead of sending a signal:  $ /bin/kill -p httpd 2617 ...   Without specifying the full path of the system command, the Bash builtin is used instead of the system command. The kill builtin doesn’t have the -p option so the command fails:  $ kill -p httpd bash: kill: p: invalid signal specification   I tried the answers listed in  but most of them only work because time is actually a shell keyword – not a shell builtin.  Other than temporarily disabling the Bash builtin with enable -n kill, the best solution I’ve seen so far is to use:  $(which kill) -p httpd   Are there other easier (involve less typing) ways to execute an external command instead of a shell builtin?  Note that kill is just an example and I’d like a generalised solution similar to the way that prefixing with the command builtin prevents functions which have the same name as an external command from being run. In most cases, I usually prefer to use the builtin version as it saves forking a new process and some times the builtin has features that the external command doesn’t.
19914
How do I kill all processes running by my own non-root account?  I have some spinning smbd  processes that I caused from my windows machine and so I telnetted into the linux server and I want to kill those spinning processes.   I don't have authority to restart services or reboot the machine.
73467
I'm not quite sure if stackoverflow or serverfault is the forum to use for this question, but ill try here.  Is there some command I can use or a file I can check in order to find out which process scheduler I'm using on my Linux system? I am not looking for the I/O scheduler, but the process scheduler, and please, do not refer to guides or howtos for what a scheduler is, what I'm simply asking is if there is a command or file I can run/check to see this. I could check the doc for my kernel but again I'm just wondering if there is a command or file i can check.  I might have been a little redundant above but that's because the posts I've seen people seem to confuse process scheduler with the i/o scheduler, and they don't seem to answer the actual question, just provide links to what a scheduler is which is not what I'm after here, so apologies if the above comments sounded rude.
76820
How do I end all processes with the same name in a more gentle way than killall does? I don't want to interrupt the processes, but leave them time to properly quit.    See also:
42456
From the question , the OP wants to repeatedly poll the pid of a process using pidof in a shell script. Of course this is inefficient as a new process must be started for the pidof program multiple times per second (I don't know that this is the cause of the CPU spikes in the question, but it seems likely).  Usually the way around this kind of thing in a shell script is to work with a single program that outputs the data you need on stdout and then doing some text processing if necessary. While this involves more programs to be running concurrently, it is likely to be less CPU intensive since new processes are not being continually created to for polling purposes.  So for the above question, one solution might be to have some program which outputs the names and pids of processes as they are created. Then you could do something like:  pids-names |   grep some_program |   cut -f 2 |   while read pid; do     process-pid "$pid"   done   The problem with this is that it raises a more fundamental question, how can pids and process names be printed as they are created?  I have found a program called ps-watcher, though the problem with this is that it is just a perl script which repeatedly runs ps so it doesn't really solve the problem. Another option is to use auditd which could probably work if the log was processed directly via tail -f. An ideal solution would be simpler and more portable than this, though I will accept an auditd solution if it is the best option.