If a job is RUNNING and a KILLJOB event is issued against it, the job will change to TERMINATED. However, the actual job running on the Agent continues to run unless manually terminated.
When a job is issued to run on an Agent, an auto_remote process is spawned for the job. This auto_remote process in turn spawns a child process which is the actual command of the job that is running.
If a KILLJOB event is issued, the auto_remote will terminate it's immediate child process and then exit.
However, if the child process has spawned other child processes... these will NOT be terminated as they are no longer linked back to the auto_remote process.
For example, a windows job is defined as follows:
/*---------------- testjob ----------------*/
insert_job: testjob job_type: c
command: & "c:\test.bat"
The test.bat file contains only:
When the job runs (in the background due to the ampersand "&") the following processes will be appear on the target machine:
auto_remote is the Agent job, and cmd.exe is it's child process which runs the 'test.bat' file. The calc.exe process was spwaned by the cmd.exe process and is no longer linked to the original auto_remote process.
If a KILLJOB event is issued in this scenario, auto_remote.exe will first kill the cmd.exe process and then exit. The 'calc.exe' process will continue to run until manually terminated.