freemode.net

killall(1M) vs killall(1)    [ Humor ]

Most Unix admins have a particularly favorite mistake they've committed.   After all, when you have a (now shrinking) variety of similar but not-quite-the-same implementations of the same general idea, you're bound to run into inconsistencies.

My personal favorite is the killall command.   On one popular (commercial) version of Unix, it does one thing.   On another popular (open-source) re-implementation of Unix, it does something rather different.

Below is the beginning of the manpage for killall(1M), found on Solaris:

Maintenance Commands                                  killall(1M)
NAME
     killall - kill all active processes
SYNOPSIS
     /usr/sbin/killall [ signal ]
DESCRIPTION
     killall is used by shutdown(1M) to kill all active processes
     not directly related to the shutdown procedure.
     killall terminates all processes with open files so that the
     mounted file systems will be unbusied and can be unmounted.
     killall sends signal (see kill(1)) to the active  processes.
     If no signal is specified, a default of 15 is used.
     The killall command can be run only by the super-user.

And below is the beginning of the manpage for killall(1), found on Linux:

KILLALL(1)                       User Commands                      KILLALL(1)
NAME
       killall - kill processes by name
SYNOPSIS
       killall [-e,--exact] [-g,--process-group] [-i,--interactive]
       [-q,--quiet] [-v,--verbose] [-w,--wait] [-V,--version] [-S,--sid]
       [-c,--context] [-s,--signal signal] [--] name ...
       killall -l
       killall -V,--version
DESCRIPTION
       killall  sends  a  signal to all processes running any of the specified
       commands. If no signal name is specified, SIGTERM is sent.
       Signals can be specified either by name (e.g. -HUP) or by number  (e.g.
       -1).
       If the command name contains a slash (/), processes executing that par-
       ticular file will be selected for killing, independent of their name.
       killall returns a zero return code if at least  one  process  has  been
       killed for each ilisted command. killall returns zero otherwise.
       A  killall  process never kills itself (but may kill other killall pro-
       cesses).

I was logged in remotely to a production Solaris box early in the morning.   Let's not mince words, it was the primary internal production server for the company.   I was on call, and I needed to kill off an errant process.   So I do the s/key dance and su to root, and execute a

# killall [whatever-the-name-of-the-boneheaded-process-was]

And then, much to my surprise, the box ups and disconnects me.

Of course, the box was doing exactly what I had told it to do - shut down all running processes not directly related to the shutdown procedure.   Solaris very happily shut down my su login, my ssh session, the ssh daemon, apache, the monitoring software, customer apps, and, well, just about everything except for init.   And then it just sat there, happily doing nothing.

It takes my brain a few minutes to realize what happened, at which point I start cursing and calling my manager (not simultaneously).   Whoops.   It's made worse that someone else who's physically closer to the box has to drive in early and reboot it.   Ergh.   Thankfully, the box is back up and running by the time most folks arrive for work.   I, however, get to slink into work with my metaphorical tail between my legs.

One of the senior engineers took me aside later that day, and pointed out that after su'ing to root, I should take a moment before executing any command to remember what platform I'm on.   And that makes a good moral for this story:   a few seconds of careful consideration can save hours of downtime and embarassment.