Infrastructure Layer
Attacks

Process Killer Attack

The Process Killer Gremlin kills targeted processes over a supplied interval throughout the length of the attack. This Gremlin can select a set of processes identified by a regular expression, or specific processes identified by their process ID (PID).

Linux

The Process Killer Gremlin sends the signal supplied by --signal (defaults to KILL) to processes identified by the rest of the supplied arguments.

This Gremlin requires the KILL capability, which is enabled for Gremlin by default at installation time. See capabilities(7)

Options

ParameterFlagRequiredDefaultVersionDescription
Signal-s stringFalseKILL1.8.0The signal to send to target processes. Values: [HUP,INT,QUIT,ILL,TRAP,ABRT,FPE,KILL,SEGV,PIPE,ALRM,TERM,USR1,USR2]
Interval-i intFalse11.8.0The number of seconds to delay before kills.
Process-p reg ex or intTrue1.8.0The process name to match (allows regex) or the process ID.
Group-g stringFalse1.8.0The group name or ID to match against (name matches only).
User-u stringFalse1.8.0The user name or ID to match against (name matches only).
Newest-nFalseFalse1.8.0If set the newest matching process will be killed (name matches only, cannot be used with -o).
Oldest-oFalseFalse1.8.0If set the oldest matching process will be killed (name matches only, cannot be used with -n).
Exact-eFalseFalse1.8.0If set the match must be exact and not just a substring match (name matches only).
Kill Children-cFalseFalse1.8.0If set the processes children will also be killed.
Full Match-fFalseFalse1.8.0If set the processes name match will occur against the full command line string that the process was launched with.
Length-l intFalse601.8.0The length of the attack (seconds).