Hitman FAQ 4

A user is not being terminated that should be

This problem is usually caused by one of two things.

1. the user is protected in some unrecognized way

2. the user is not considered idle by Hitman

To determine if a user is being protected for some reason:

1. Get the user logged in

2. Delete any old dump files

$ delete hitman_dat:dump.dmp;*

3. Wait at least 5 minutes

4. Use Hitman's dump command to obtain information about all the processes Hitman sees with that users username

$ hitman /dump /user=username

5. Type, or edit, the dump file

$ type hitman_dat:dump.dmp

6. Inspect the three rows of flags in the middle portion of the dump. In this example the user is protected

because the server port they've connected through is protected.

F F F T F

F F F F F

F F F F T

7. If "FLAG" in the above list is "F" then the user is not protected. Next check the ignore flag:

Privileged ? : T Ignore ? : T

If it's True it means that Hitman is ignoring this process for some reason. Check the mode and state codes, a table of possible values can be found in the Hitman manual.

State: 6 Mode: 3 Type: 3

If these values indicate that the process is not "Interactive" Hitman will ignore this process. You may need to modify your parameters to include more than "interactive" processes; refer to the /type qualifier in the Hitman manual. Be cautious when making changes to these values as it may make other processes

8. If there is no reason for this process to be ignored and it's not protected you must determine if Hitman sees the process as "idle" or not. Check the time values in the dump:

Minutes First Second Final

Idle : 0 30 36 42

Connect : 18 0 0 0

In this example the process has been logged in for at least 18 minutes but is not currently idle. The first, second and final idle warning times that will be used if the process is idle are indicated.

CPU BIO DIO

Total Usage: 504 1099 308

Last Interval Usage: 0 0 1

Threshold: 3 1 0

Looking at these values we can see that in the last data collection interval the process consumed one DIO. Since the threshold is 0 this means, to Hitman, that the process is not idle and should not be killed. At this point you must decide:

1. If the process is doing something - if so everything is as expected and no changes are needed.

2. If the process is idle you may address this problem by upping the system wide dio threshold value:

$ hitman /dio_threshold=2 /file=both

When changing thresholds we strongly recommend you change one at a time and increase it only slightly. If the user is still not being killed you may increase it again until you achieve the lowest possible value that will allow Hitman to see this user as idle. Users are strongly cautioned against increasing more than 1 threshold for the system wide values - experience shows that this frequently results in users being terminated that are not actually idle.

3. If the process is idle and running an image that has some background usage (ie: automatic timed backups or checking for e-mail) you may increase the thresholds for that image only. This is much safer than increasing the system wide thresholds.

The image name, as Hitman sees it, can be found in the dump record:

Image Name: BRMENU

$ hitman /image=brmenu /dio_threshold=2 /file=both

the cpu and buffer io thresholds will default to the current system wide values.