How to use kill commands in Linux

Although Linux is considered a robust operating system with very few issues with applications, programs sometimes become unresponsive. When this happens, they can consume plenty of system resources or take down the entire system. Usually, these applications cannot be restarted automatically. 

If the process or application is still running and will not get shut down completely, you need to use a command to terminate the process in Linux. It is necessary to either restart the whole system or end the specific application process when this happens. Since restarting the entire system takes time and can create significant inconvenience for the clients, it is much easier to kill a process in Linux.

Understanding processes and process IDs (PIDs)

A process is the working mechanism of a program that is currently being executed. Upon its creation, every process is automatically assigned a unique process identification number (PID). When a process dies, its PID gets returned to an available pool, and another process can then reuse it.

We can use multiple commands on a server to find a specific PID. For example, we can use the topcommand, which will give us a table of all the running processes. With this, we can find the PID of a process along with other useful system information.

Another way to find the PID is with the ps command. Below, we see a few different ways to use the ps command to find the PID:

[root@host ~]# ps faux | grep systemd
Root 1 0.0 0.6 96656 11260 ? Ss Jan24 0:08 /usr/lib/systemd/systemd --switched-root --system --deserialize 18
Root 533 0.0 1.3 125588 22832 ? Ss Jan24 0:25 /usr/lib/systemd/systemd-journald
Root 564 0.0 0.5 107440 9248 ? Ss Jan24 0:00 /usr/lib/systemd/systemd-udevd
Dbus 684 0.0 0.3 73540 5524 ? Ss Jan24 0:06 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
Root 743 0.0 0.4 95736 7760 ? Ss Jan24 0:01 /usr/lib/systemd/systemd-logind
Root 66199 0.0 0.0 12108 1060 pts/0 S+ 08:28 0:00 \_ grep --color=auto systemd
Root 66153 0.0 0.5 93212 9472 ? Ss 08:27 0:00 /usr/lib/systemd/systemd --user
[root@host ~]#
[root@host ~]# ps -eo user,pid,command | grep systemd
[root@host ~]# ps -eo user,pid,command | grep systemd
root 1 /usr/lib/systemd/systemd --switched-root --system --deserialize 18
root 533 /usr/lib/systemd/systemd-journald
root 564 /usr/lib/systemd/systemd-udevd
dbus 684 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 743 /usr/lib/systemd/systemd-logind
root 66153 /usr/lib/systemd/systemd --user
root 66213 grep --color=auto systemd
[root@host ~]#

We can also use the pidof process_name and the pgrep process_name commands to find out the corresponding PIDs of that process:

[root@host ~]# pidof systemd
66156 66153 1
[root@host ~]#
[root@host ~]# pgrep systemd
1
533
564
743
66153
[root@host ~]#

To terminate a process in Linux, we can use the kill command. It is a built-in command that sends a signal to a specified process. The Linux operating system will stop the process in question.

An overview of kill signals

Signals are a form of dialogue between processes from other processes, the kernel, or the specific process itself. Each process has a current behavior or disposition, of which there are five types:

• Term
• Ign
• Core
• Stop
• Cont
  

These attributes determine how the process will behave when a signal is delivered to it. The Term’s default action is to terminate the process, which is primarily used by the killcommand.

There are a total of 64 signals used with the kill command. The one we send will depend on the desired result, as different signals have different effects and outcomes. Out of these 64 signals, the first 31 are standard signals. The rest are real-time signals.

The main difference between the two types of signals is that standard signals cannot be queued, while real-time signals can. What this means is that the information associated with the first instance of a standard signal is received by a process. Real-time signals will queue the information associated with it, allowing reception of multiple signals. 

We can see a complete list of available signals with the command kill -lor in the signal manual page by entering the man 7 signal:

[root@host ~]# kill -l
1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL 5) SIGTRAP 6) SIGABRT 
7) SIGBUS 8) SIGFPE 9) SIGKILL 10) SIGUSR1 11) SIGSEGV 12) SIGUSR2 
13) SIGPIPE 14) SIGALRM 15) SIGTERM 16) SIGSTKFLT 17) SIGCHLD 
18) SIGCONT 19) SIGSTOP 20) SIGTSTP 21) SIGTTIN	22) SIGTTOU 23) SIGURG	24) SIGXCPU 25) SIGXFSZ 26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 
29) SIGIO 30) SIGPWR 31) SIGSYS	34) SIGRTMIN 35) SIGRTMIN+1 
36) SIGRTMIN+2 37) SIGRTMIN+3 38) SIGRTMIN+4 39) SIGRTMIN+5 
40) SIGRTMIN+6	41) SIGRTMIN+7 42) SIGRTMIN+8 43) SIGRTMIN+9 
44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12 47) SIGRTMIN+13 
48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14	51) SIGRTMAX-13 
52) SIGRTMAX-12 53) SIGRTMAX-11 54) SIGRTMAX-10 55) SIGRTMAX-9 
56) SIGRTMAX-8 57) SIGRTMAX-7 58) SIGRTMAX-6 59) SIGRTMAX-5 
60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2 63) SIGRTMAX-1 
64) SIGRTMAX
[root@host ~]#

For most of these signals, a program may or may not specify a different action. If the program defines the action, it is called catching or handling the signal. If no action occurs, the signal will be ignored.

The most commonly used signals are as follows:

The SIGKILL and SIGSTOP signals cannot be caught, blocked, or ignored, while the SIGTERM signal can be caught or ignored. That is why we can use SIGKILL in Linux when SIGTERM fails to stop or end the process.

In the example below, the kill -15 (SIGTERM)command does not stop the Java process. Therefore, in cases like these, Linux must force kill the processes:

[root@host ~]# ps -eo user,pid,command | grep java
tomcat 59815 /usr/bin/java -Djava.util.logging.config.file=/usr/local/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat9/bin/bootstrap.jar:/usr/local/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat9 -Dcatalina.home=/usr/local/tomcat9 -Djava.io.tmpdir=/usr/local/tomcat9/temp org.apache.catalina.startup.Bootstrap start
root 66401 grep --color=auto java
[root@host ~]# kill -15 59815
[root@host ~]#

Using the Linux kill command

General rules

There are other general rules for stopping a process in Linux. It is essential to note that regular users can send signals to their own processes but not to those that belong to other users. The root user, on the other hand, can send signals to all other user’s processes. Here are some additional general rules:

• Signals sent depend on what PID we pass to the command. 
• If the PID is greater than zero, then the signal is sent to the process with that PID.
• If the PID is equal to zero, the signal is sent to all processes in the process group (PGID) of the shell involved in the kill command. 
• If the PID is equal to -1, the signal is sent to all processes with the same user ID as the user who has invoked the kill command. 
• If the PID is less than -1, the signal is sent to all processes in the process group with the process group ID equal to the absolute value of the PID.
  

Syntax and basic usage of the Linux kill command

The kill command sends a signal to terminate a process in Linux. By default, it will send a TERM signal, if no other signal is defined. That signal will try to stop the process gracefully in the Linux operating system.

If that fails, try terminating the process with another signal because the signal may have been caught or ignored. You kill a process in Linux with a different signal by defining it using a number (kill -9), with a SIG prefix (kill -SIGkill), or without the SIG prefix (kill -kill).

As you can see, the kill -9 (SIGKILL)command terminated the Java process:

[root@host ~]# ps -eo user,pid,command | grep java
tomcat 66469 /usr/bin/java -Djava.util.logging.config.file=/usr/local/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat9/bin/bootstrap.jar:/usr/local/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat9 -Dcatalina.home=/usr/local/tomcat9 -Djava.io.tmpdir=/usr/local/tomcat9/temp org.apache.catalina.startup.Bootstrap start
root 66516 grep --color=auto java
[root@host ~]# kill -9 66469
[root@host ~]# 
[root@host ~]# ps -eo user,pid,command | grep java
root 66530 grep --color=auto java
[root@host ~]#

Invoke the killcommand with the following syntax.

kill [OPTIONS] [PID]

For example, if we find that the process ID for an httpd process is 21567, we can try to kill it gracefully by invoking the following command. It will send the TERM signal:

[root@host ~]# kill 21567 

If this does not stop the process, we can then try to kill it with the signal SIGKILL, which will kill it without first waiting for the process to be properly closed. To do this, you use one of the following commands:

[root@host ~]# kill -9 21567
[root@host ~]# kill -SIGKILL 21567
[root@host ~]# kill -kill 21567

Terminating a process by process ID (PID)

To kill a process, you must know its process ID (PID). The easiest way to get the process ID is through the ps command. For example, we only want the listing associated with Firefox. So this command would look like:

ps aux | grep firefox

Once you have the PID of the application, use this command to kill the process immediately:

kill -9 PID

Terminating multiple processes simultaneously

If you have more than one PID, you can kill them simultaneously by providing all the PIDs:

kill -9 PID_1 PID_2 PID_3

Sending specific signals to processes

As mentioned before, the basic syntax of the Linux kill command is:

kill [signal] PID

Signals can be specified in three ways:

1. Using numbers
2. Using the SIG prefix
3. Without using the SIG prefix.

You can list all of the kill signals and signal numbers by running the following command:

kill -l

1. Specifying by number

We can specify a signal using a number. For example, SIGKILL has a signal number of 9, so killing a process with PID 9338 using the SIGKILL's signal number would be:

kill -9 9338

2. Specifying using the SIG prefix

Signals can also be specified using the SIG prefix, so sending a kill signal to PID 9338 using the SIG prefix can be accomplished using the following command:

 kill -SIGKILL 9338

3. Specifying without the SIG prefix

So, kill signals can also be sent without the use of the SIG prefix, so sending a kill signal without SIG prefix to PID 9338 would look like this:

kill -kill 9338

Gracefully terminating processes with SIGTERM

The default termination signal is a SIGTERM (15) signal. SIGTERM tells a process that it must close, then gives it 30 seconds to gracefully terminate all processes. If the process does not stop within 30 seconds, then a follow-up signal, SIGKILL, will be initiated. The pair signal, SIGKILL, will automatically terminate a process, no matter what it was doing.

Advanced Linux kill command techniques

Using pkill to kill Linux processes by name

So pkill is a command line tool that sends signals to the processes of a running program based on provided criteria. The processes can be specified by their full or partial names, a user running the process, or other attributes. When invoked without options, pkill sends the 15 (TERM) signal to the PIDs of all running programs which match the given name. For example, to gracefully stop all firefox processes, you would run the following:

pkill -15 firefox

More details about the pkill command

A command similar to killall is pkill, which also can kill a process in Linux by name. It takes a pattern as an argument and matches it against running processes’ names, so it doesn’t need an exact name. For example, we can terminate httpd with something like this:

pkill http

Although this is not the exact process name, it will find the processes that contain this pattern and send the terminate signal to httpd.

More details about the skill command

The skill command uses the same syntax as the kill command to send termination signals. The default TERM signal is primarily used here:

skill [signal] [options]
[root@host ~]# ps -eo user,pid,command | grep tomcat
tomcat 66546 /usr/bin/java -Djava.util.logging.config.file=/usr/local/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat9/bin/bootstrap.jar:/usr/local/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat9 -Dcatalina.home=/usr/local/tomcat9 -Djava.io.tmpdir=/usr/local/tomcat9/temp org.apache.catalina.startup.Bootstrap start
root 66846 grep --color=auto tomcat
[root@host ~]# skill -9 66546

It is recommended to use the kill, pkill, or killall commands instead of skill.

Employing killall to terminate multiple processes by name

The killall command is a tool in the Linux command line that allows you to terminate processes by their name. It is an easy way to stop multiple processes at once, saving you the time and effort of killing each process individually.

The basic syntax of the killall command is:

killall process_name

In this syntax, the process_name is the name of the process you want to terminate. For example, to killall instances of the firefox process, you would use the command:

killall firefox

To kill all instances of the firefox process and send a SIGKILL signal to force the process to terminate immediately:

killall -s SIGKILL firefox

More details about the killall command

Additionally, we can kill a process in Linux by using the unique PID, the kill command, or with the process name and the killallcommand. Apply the same syntax with the killall command, invoke killall [signal] [process_name], as in this example:

killall -9 httpd 

This command will terminate the httpd process in Linux without waiting for it to stop gracefully. 

When determining which process the signal is sent to, it will match the argument name exactly, as in this example:

killall httpd 

The command will send a termination signal to all processes that are exactly named httpd.

If you run the same command with a service that does not exist, it will show an error that there is no process with that name. Since Apache uses httpd as the process name instead of http, the following command would yield such an error:

killall http

Sending signals to process groups

The killpg command will send a signal to a process group (pgrp). If the pgrp is 0, a signal is sent to the calling process group. Otherwise, the killpgrp command does not take any other arguments and kills all processes within the same process group.

Using the Linux kill command in conjunction with other command

Using kill With ps

The kill command is most commonly used together with ps command. Using the ps command you can find information about a process, like its name or PID which are needed in order to terminate it using the Linux kill command.

Using kill With grep

So grep is another important command commonly used with ps in order to sort out its output and avoid going through the whole output of the ps command in order to terminate the process later using its name or PID.

Dealing with unresponsive processes

Identifying unresponsive processes

In Linux, processes can be in different states. Here is the list for some of them:

• Running(R)
• Interruptible(S)
• Uninterruptible(D)
• Stopped(T)
• Zombie(Z)
  

You can run ps command and grep for the states:

ps aux | awk '{if ($8 ="D") print}'

Killing processes owned by other users

If you need to stop a process that is owned by another user, you can use the sudo command to execute killall with root privileges. This is useful if you are a system administrator and need to stop processes that are owned by other users.

Using the kill commad with the SIGKILL signal for forceful termination

Using kill command with SIGKILL signal sends a kill signal to end any process immediately when sent with a PID or a processname. It is a forceful way to terminate a or set of processes. This signal cannot be handled (caught), ignored or blocked.

More advanced commands and techniques

More details about the mysql_zap command

Another command that will stop a process in Linux that matches a specific pattern is mysql_zap. An identified process will match this pattern if its output line from the ps command contains that pattern. As with other commands, mysql_zap will send a TERM signal by default unless another signal is specified. The syntax used for this command is as follows:

[root@host ~]# mysql_zap [signal] [pattern]

The mysql_zap command was depreciated in MariaDB as of version 10.2. The alternative is the pkill command.

More details about the mk-kill command

Use the mk-kill command to kill MySQL queries that match a specified criterion. If a file is passed to mk-kill, it will read the queries from that file, containing the output of SHOW PROCESSLIST. If there is no file given as an argument, mk-kill will execute a SHOW PROCESSLIST in MySQL to obtain the queries. Here are two examples of that command:

[root@host ~]# mk-kill --busy-time 60 --print
[root@host ~]# mk-kill --match-command Sleep --kill --no-only-oldest --interval 10

The first command will kill any MySQL queries found to be running longer than sixty seconds. The second command checks for any sleeping process (a process that needs resources that are not currently available) every ten seconds and ends any that are found.

More details about the mkill

Another command related to mk-kill is the mkill command. This command will kill slow queries where found.

It will kill these queries based on the following factors:

• Query Time
• Host
• User
• Database
• State
• Query Content
  

More details about the tkill and tgkill commands

If we would like to kill a specific thread instead of an arbitrary one within an entire process, we can do so with tkill and tgkill commands. The tkillcommand is the depreciated predecessor to tgkill.

The tkill command only allows for the target thread ID to be specified, leading to the termination of an incorrect thread if that thread ID is recycled (used for another thread. On the other hand, tgkill will signal the thread with the thread ID in the thread group ID (TGID).

More details about the killpg command

Another command used to send signals to a process group is killpg. The killpg command will send a signal to a process group (pgrp). If the pgrp is 0, a signal is sent to the calling process group. Otherwise, the killpgrp command does not take any other arguments and kills all processes within the same process group.

More details about the tcpkill command

We can also kill specific Transmission Control Protocol (TCP) connections that are in progress with the tcpkill command. Using this command, we can specify a network interface to listen on (as an option) or determine the degree of force (using a number from 1-9) to use in terminating a connection. The default degree of force is 3.

The following command is the syntax of tcpkill:

[root@host ~]# tcpkill [-i interface] [-1...9] expression
[root@host ~]# tcpkill -i eth0 port 21

More details about the lxc-kill command

If we need to stop a process in Linux running inside a virtualized container on Ubuntu (for example, if using Kubernetes or Docker), we can use the lxc-kill command. The command will send a numeric signal to the first process of the container to end a process.

The syntax of the lxc-kill command is as follows:

lxc-kill --name=NAME SIGNUM

More details about the arckill command

The arckill command is used to kill running jobs on an ARC-enabled resource. Advanced Resource Connector (ARC) is a grid computing middleware that provides a common interface for submitting computational tasks to distributed systems.

You can either use the jobid or the jobname to refer to a job, if the attribute was submitted:

arckill -j filename.xml (<jobid#>)

More details about the pvm_kill command

To terminate a specified PVM process (a message-passing system), we can use the pvm_kill command. It will send a termination signal to a PVM process that is identified by the task identifier (TID). This command is primarily used with a larger program like so:

• In C: info = pvm_kill( tid );
• In Fortran: CALL PVMFKILL( TID, INFO )

More details about the xkill command

The xkill command is a graphical way to kill an application. When you enter the command xkill in the terminal on a system with a graphical user interface (GUI), the mouse cursor will change into a plus sign (depending on your icon set). You then left-click an unresponsive window to close it.

The xkill command instructs the xserver to terminate the program in the selected window. Its syntax is as follows:

xkill [-display displayname] [-id resource] [-button number] [-frame] [-all]

Precautions and best practices

Potential risks associated with killing processes

If the process was writing to a file system or communicating with other processes (perhaps not even on the same host), then terminating it might cause something to trip over (like an orphan process, for example). You will need to make sure that everything else on the system is prepared to cope with your process going away.

Precautions before using Linux kill commands

The kill command in Linux is a very powerful tool for managing processes. You should only kill processes that you know are safe to kill as killing system processes can cause instability. It’s always better to first try and reboot the system or try to find the root cause of the issue.

Best practices for process termination

As mentioned above, always make sure that the process is safe to kill in order to avoid any instability issues. Make sure that you are not terminating any of the system processes unless it is absolutely necessary.

Wrapping up

As we can see, there are several ways to terminate a process in Linux using a variety of Linux kill commands. However, one should exercise caution when using these commands to prevent incorrectly terminating a needed process that can kill an application that should not be killed. It could also cause an interruption to an essential service, which could lead to many issues.

With that in mind, always consult the appropriate man pages in the Linux terminal for each command. If you are not completely sure, get in touch with your web hosting supportteam or system administrator for assistance.

As we continue to move forward into the future, your knowledge should grow to keep up with your competitors. Learn how one of our clients has capitalized on this idea by reading the Rapid Crush Case Study, which details their journey.