You can use kill -9 11394
to kill the process completely ungracefully, this will invoke the following:
From The 3 most important "kill" signals on the Linux/UNIX command line:
The kernel will let go of the process without informing the process of it. An unclean kill like this could result in data loss. This is the "hardest", "roughest" and most unsafe kill signal available, and should only be used to stop something that seems unstoppable.
The normal way would be to change the configuration of the monitor program so that it doesn't keep doing that thing you don't want it to do. I'm going to assume you can't do that for some reason, but anything else is a workaround that won't work in all circumstances.
You can't blacklist a process: a process is a runtime entity. The process doesn't exist until it's started. Once it's started, it's too late to prevent it from starting. And how would you identify the process that shouldn't have started, anyway?
You can blacklist a program, or more precisely, a particular installation of a program. All programs are started from an executable file. So if you arrange for the executable file not to exist, it won't start. You could remove it, rename it, or even just make it not executable:
chmod a-x /path/to/program
If you don't want or can't modify the filesystem for some reason, but have root access, you could even use a security framework such as SELinux or AppArmor to forbid the monitor from executing this particular program. But that's more complicated.
However, if a monitor keeps trying to respawn that program, it may or may not cope sensibly if the executable disappears. It may spam you (or some log files with error messages).
Assuming that the monitor only keeps the program alive (as opposed to checking the program functionality, e.g. a monitor for a web server process might periodically try to access a web page and restart the server if it isn't responding), you could replace the program by a program that does nothing but block forever. There's no program that does this in the basic utility collection, but you can write one easily:
#!/bin/sh
while sleep 999999999; do :; done
Depending on why you want to block that program, you may or may not be able to achieve a similar result by suspending the process of the original program, with pkill -STOP programname
or kill -STOP 1234
where 1234 is the process ID. This keeps the process around, but doing nothing until explicitly resumed (with kill -CONT
). The process won't consume any CPU time, and its memory will get swapped out when the system requires RAM for other things, but it does keep consuming resources such as open files.
Best Answer
Starts automatically with another process ID means that it is a different process. Thus there is a parent process, which monitors its children, and if one dies, it gets respawned by the parent. If you want to stop the service completely, find out how to stop the parent process. Killing it with
SIGKILL
is of course one of the options, but probably not The Right OneTM, since the service monitor might need to do some cleanup to shut down properly.To find the monitor process, you might need to inspect the whole process list, since the actual listeners might dissociate themselves from their parent (usually by the
fork() + setsid()
combo). In this case, I find the output ofps faux
(fromprocps
at least, might vary for other implementations) rather handy - it lists all processes in a hierarchical tree. Unless there has been a PID wrap (see also wikipedia), the monitor PID should be smaller than PID of any of the listeners (unless of course you hit a PID-wraparound).