Pausing a task

Pausing a task

[Richard B. Johnson]

How can I (as root) pause or suspend a process?
On VAX/VMS one could do `set process=suspend`. This
would allow the system manager to check on a possibly
rogue user.

Let's say that "Hacker Jack" just got fired because
he was disrupting a project. One needs to find any of
his processes where he might be deleting a project
tree. Pausing, rather than killing the tasks would
allow evidence to be gathered. Basically, I need
to set the task(s) priorities to something that
will take them out of the run-queue altogether.

Cheers,
Dick Johnson
Penguin : Linux version 2.6.11.9 on an i686 machine (5537.79 BogoMips).
  Notice : All mail here is now cached for review by Dictator Bush.
                  98.36% of all statistics are fiction.

Re: Pausing a task

[Jan-Benedict Glaw]

[-- Attachment #1: Type: text/plain, Size: 1157 bytes --]

On Mon, 2005-06-13 11:50:34 -0400, Richard B. Johnson <linux-os@analogic.com> wrote:
> 
> How can I (as root) pause or suspend a process?
> On VAX/VMS one could do `set process=suspend`. This
> would allow the system manager to check on a possibly
> rogue user.
> 
> Let's say that "Hacker Jack" just got fired because
> he was disrupting a project. One needs to find any of
> his processes where he might be deleting a project
> tree. Pausing, rather than killing the tasks would
> allow evidence to be gathered. Basically, I need
> to set the task(s) priorities to something that
> will take them out of the run-queue altogether.

~# pkill -SIGSTOP -U richard

< examine the situation, attach gdb/strace/ltrace/whatever >

If you just want to let'em continue:

~# pkill -SIGCONG -U richard

MfG, JBG

-- 
Jan-Benedict Glaw       jbglaw@lug-owl.de    . +49-172-7608481             _ O _
"Eine Freie Meinung in  einem Freien Kopf    | Gegen Zensur | Gegen Krieg  _ _ O
 fuer einen Freien Staat voll Freier Bürger" | im Internet! |   im Irak!   O O O
ret = do_actions((curr | FREE_SPEECH) & ~(NEW_COPYRIGHT_LAW | DRM | TCPA));

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Pausing a task

[Vadim Lobanov]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: TEXT/PLAIN; charset=X-UNKNOWN, Size: 1291 bytes --]

On Mon, 13 Jun 2005, Jan-Benedict Glaw wrote:

> On Mon, 2005-06-13 11:50:34 -0400, Richard B. Johnson <linux-os@analogic.com> wrote:
> >
> > How can I (as root) pause or suspend a process?
> > On VAX/VMS one could do `set process=suspend`. This
> > would allow the system manager to check on a possibly
> > rogue user.
> >
> > Let's say that "Hacker Jack" just got fired because
> > he was disrupting a project. One needs to find any of
> > his processes where he might be deleting a project
> > tree. Pausing, rather than killing the tasks would
> > allow evidence to be gathered. Basically, I need
> > to set the task(s) priorities to something that
> > will take them out of the run-queue altogether.
>
> ~# pkill -SIGSTOP -U richard
>
> < examine the situation, attach gdb/strace/ltrace/whatever >
>
> If you just want to let'em continue:
>
> ~# pkill -SIGCONG -U richard

I think that's supposed to be "-SIGCONT" instead. :-)

> MfG, JBG
>
> --
> Jan-Benedict Glaw       jbglaw@lug-owl.de    . +49-172-7608481             _ O _
> "Eine Freie Meinung in  einem Freien Kopf    | Gegen Zensur | Gegen Krieg  _ _ O
>  fuer einen Freien Staat voll Freier Bürger" | im Internet! |   im Irak!   O O O
> ret = do_actions((curr | FREE_SPEECH) & ~(NEW_COPYRIGHT_LAW | DRM | TCPA));
>

-Vadim L

Re: Pausing a task

[Jan-Benedict Glaw]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

On Mon, 2005-06-13 09:27:41 -0700, Vadim Lobanov <vlobanov@speakeasy.net> wrote:
> On Mon, 13 Jun 2005, Jan-Benedict Glaw wrote:
> > On Mon, 2005-06-13 11:50:34 -0400, Richard B. Johnson <linux-os@analogic.com> wrote:
> > > Let's say that "Hacker Jack" just got fired because
> > > he was disrupting a project. One needs to find any of
> > > his processes where he might be deleting a project
> > > tree. Pausing, rather than killing the tasks would
> > > allow evidence to be gathered. Basically, I need
> > > to set the task(s) priorities to something that
> > > will take them out of the run-queue altogether.
> >
> > ~# pkill -SIGSTOP -U richard
> >
> > < examine the situation, attach gdb/strace/ltrace/whatever >
> >
> > If you just want to let'em continue:
> >
> > ~# pkill -SIGCONG -U richard
> 
> I think that's supposed to be "-SIGCONT" instead. :-)

Of course. You passed the test :->

MfG, JBG

-- 
Jan-Benedict Glaw       jbglaw@lug-owl.de    . +49-172-7608481             _ O _
"Eine Freie Meinung in  einem Freien Kopf    | Gegen Zensur | Gegen Krieg  _ _ O
 fuer einen Freien Staat voll Freier Bürger" | im Internet! |   im Irak!   O O O
ret = do_actions((curr | FREE_SPEECH) & ~(NEW_COPYRIGHT_LAW | DRM | TCPA));

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]