Command to remove the first N number of lines in input

awkcommand lineheadsedtail

Background

I am running an SSH server and have this user that I want to delete. I cannot delete this user because he is currently running a few processes that I need to kill first.

This is the pipeline I am using currently using to find out all the process ids of the user I am currently using:

ps -u user | awk '{print $1;}'

The output looks like this:

I want to pipe this to kill -9 to kill all processes so I can delete this stupid user like this:

ps -u user | awk '{print $1;}' | sudo xargs kill -9

But this does not work because of the PID header:

kill: failed to parse argument: 'PID'

The question

I am thinking that there has to be a simple Unix command to remove the first line of input.

I am aware that I can use tail for this but I don't want to count how many lines the input contains to figure out exactly how many I want to display.

I am looking for something like head or tail but inverted (instead of displaying only the first/last part of the stream it displays everything but the start/end of stream).

Note

I managed to solve this issue I had by simply adding | grep [[:digit:]] after my awk command but I am still looking for a way to delete first line of a file as I think would be quite useful in other scenarios.

Best Answer

NOTE: if your system already has pgrep/pkill then you are re-inventing the wheel here. If your system doesn't have these utilities, then you should be able to format the output of ps to get the unencumbered PID list directly e.g. ps -u user -opid=

If you are already using awk, there is no need to pipe through an additional process in order to remove the first line (record): simply add a condition on the record number NR

ps -u user | awk 'NR>1{print $1;}'

Since you mention head and tail, the formula you probably want in this case is tail -n +2

Related Solutions

SED – Print Lines Before and After Pattern Match Excluding Other Patterns

Though the expected output is not clear, I will try. If you have the gnu utils on Solaris, you can use gawk and ggrep in a very simple manner:

gawk 'NF > 0' fileName  |ggrep -C5 pattern

You can add a | ggrep -v somePattern at the end to filter out unwanted words.

Shell – Passing a list of two PIDs to xargs only kills the first using ssh

The $2 is within double quotes on the local shell command line, so expanded by your local shell (probably to the empty string).

So the command run on the remote host is something like:

 ps -ef | grep foo | grep -v grep | awk {'print '} | xargs kill -9

That awk command is a no-op (prints all the lines) and xargs will eventually run:

 kill -9 <all-the-words-present-in-the-output-of-ps|grep...>

That includes pid and ppid, user names...

Also if the pid of the kill command is in that list, it will kill itself and thus not be able to kill the remaining ones in the list.

Here, you'd want:

ssh foo@<IP Address> 'pkill -KILL -f foo'

(kills all processes whose command line (at least the first few kilobytes of it) contains foo).

Or if the remote system doesn't have a pkill command:

ssh foo@<IP Address> '
  ps -Ao pid= -o args= |
    awk "/[f]oo/ {print \$1}" |
    xargs kill -s KILL'

We use single quotes on the local side (so no variable expansion there), and double quote for the awk code in the remote shell command line, so we need to escape the $ in $1 so that it is not expanded by the remote shell.

awk is a superset of grep, you generally don't need to pipe them together. Best is to tell ps to output only the things you want to match on, here assuming you want to search for foo in the list of arguments displayed by ps as your usage of -f suggests.

If you want to kill all processes of the remote user (here of user foo and sshing as foo), you could do:

 ssh foo@<IP Address> 'kill -s KILL -- -1'

That will kill all the processes that the user has permission to kill. For a normal user, that's all processes whose real or saved set user id is the same as the real or effective user id of the killing process.

Or:

 ssh foo@<IP Address> 'pkill -KILL -U "$(id -u)"'

(or pkill -U foo). To kill all processes whose real user id is the same as the effective user id of the remote user.

Or you could do:

 ssh foo@<IP Address> '
   trap "" HUP
   ps -Ao sid= -o pid= -U "$(id -u)" |
     awk "\$1 != $(ps -eo sid= -p "\$\$") {print \$2}" |
     xargs kill -s KILL'

(checking on sid so that kill doesn't kill itself, the shell, awk or xargs, and ignoring SIGHUP in case killing the user sshd process causes that signal to be sent)

We're assuming the login shell of the remote user is Bourne-like. Those commands would have to be adapted if the login shell of the remote user is of the csh or rc families which have a different syntax for instance.

It's also better practice to refer to signals by their name rather than number as that makes it clearer and the signal number can change from system to system (9 for SIGKILL is quite universal though).