Is sending the SIGKILL to a swapped process unswapping it before killing?

Question

Suppose that I want to terminate a process on Linux machine with swap (which is actually a zram). The swap is a half of RAM's size. There is only 10% of free space in RAM and the swap is almost full too.

The process is using only 2% of RAM but about 90% of swap.

Doing a soft close (SIGTERM) and allowing the process to catch the signal and close by itself would cause unswapping all swapped mappings, but there is no enough free RAM to fit the whole process.

Because of that it may be better to kill the process with SIGKILL but I'm still afraid that OOM-killer would kill other processes or even whole X session or init due to run out of memory.

So is sending a kill signal make kernel to move swapped parts of process into physical memory? (What should I expect? Does it depend on kernel's version?)

If so, what to do in such case? The goal is to terminate the process without touching the rest (there are other important processes running).

Moreover how to kill it correctly when it's not a one process but a processes' tree and I can't let the application terminate by itself?

Answer 1

Generally-speaking, pages are not swapped back into RAM unless they are needed. That is, the page would only be loaded back into RAM if the page is actually accessed by something (causing a page fault exception in the MMU which the OS would handle by loading the page back into RAM before allowing the accessing thread to continue). Hard-killing the process (with SIGKILL) does not run any of the process's threads, so the killed process can't try to access any of its pages, and those pages should not get loaded into RAM.

In fact, even if you kill the process "gently" by sending it a signal that it can catch and run a graceful shutdown, the OS will still only swap in the pages the process actually accesses. Furthermore, even if all RAM is full and your process needs to access a swapped page as part of its shutdown procedures, the OS will select some other page of RAM to swap out to make room in RAM for the page your program needs. As long as there's some space in the swap partition on disk, this swapping of pages can continue indefinitely, keeping everything alive, without triggering the OOM killer. So, in the scenario you describe, you should be safe to gracefully terminate your process.

One option for tracking and killing processes in a process tree on Linux is to use cgroups (short for Control Groups). If you start your top level process in a particular cgroup, all of its children will be in the same cgroup. When you decide you want to kill all of those processes, you can just tell the cgroup to kill everything in it (see cgroup.kill). This will send a SIGKILL to everything in the cgroup, hard-killing it.

Cgroups can also help you prevent your processes from consuming too much memory (among other things) in the first place by setting a memory.max limit on your cgroup. If the memory usage of all the processes in the cgroup combined exceeds the cgroup's memory.max limit, the OOM Killer will kill something in the cgroup, leaving the rest of your system alone.

Answer 2

regarding killing the whole process tree, you may try this:

# in pid is saved pid of the parent process
CPIDS=`pgrep -P $pid` # gets pids of child processes
for cpid in $CPIDS ; do kill -9 $cpid ; done # first kill children
kill -9 $pid # then the parent (yeah, that sound kinda bad)