Linux · process & service management

kill

asking a process to stop

Despite the name, kill only delivers a signal to a process ID. The default, SIGTERM, asks the program to clean up and exit, and a well-written program does. SIGKILL is different: the kernel removes the process without telling it, so nothing gets saved or closed.

Ask with TERM first, and reach for KILL only when asking has failed.

Sends

A signal

to one or more PIDs

Default

SIGTERM (15)

a request to exit cleanly

Last resort

SIGKILL (9)

cannot be caught or ignored

Allowed on

Your own processes

root may signal any

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashshell builtin

$ kill 4120

$ ps -p 4120

1 PID TTY TIME CMD

$ kill 4188

$ ps -p 4188

PID TTY TIME CMD

2 4188 pts/0 00:00:07 worker

3$ kill -9 4188

$ kill -l | head -2

4 1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL 5) SIGTRAP

6) SIGABRT 7) SIGBUS 8) SIGFPE 9) SIGKILL 10) SIGUSR1

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

A header and nothing else means it worked

kill printed nothing; ps finds no process 4120. The program received SIGTERM, shut down cleanly and exited.

This one ignored the request

Process 4188 is still listed after a plain kill. It is stuck, or it handles SIGTERM and chose to carry on.

-9 is not a request

SIGKILL is acted on by the kernel, not the program. It always works, and the process gets no chance to flush files or release locks.

Signals have numbers and names

kill -l lists them. SIGHUP (1) traditionally means "reload your configuration"; SIGINT (2) is what Ctrl+C sends.

Switches

A switch changes how the command behaves. These are the ones used day to day; man kill lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-l: List every signal name and its number.
-15: SIGTERM, the default: ask the process to shut down cleanly. Also written -TERM.
-9: SIGKILL: stop the process at once, with no chance to clean up. Also written -KILL.
-1: SIGHUP: for many services, re-read the configuration. Also written -HUP.
-STOP: Pause the process. -CONT resumes it.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

kill -HUP 1042

Asks a daemon to re-read its configuration without stopping.

pkill -f "node server.js"

Signals every process whose command line matches, without looking up PIDs.

kill -STOP 4120 && kill -CONT 4120

Freezes a process and later lets it continue.

kill -0 4120 && echo alive

Signal 0 sends nothing: it only tests whether the process exists and you may signal it.

In cybersecurity

A signal is the bluntest control there is over a running program, which is why who may send one is tightly restricted.

-9 can corrupt data

A database killed mid-write has no chance to finish. Use the service manager or SIGTERM and wait before escalating.

Killing security tooling

Stopping the logging or monitoring agent is an early step in many intrusions. Alert when those processes disappear.

PIDs are reused

A PID noted a minute ago may now belong to another process. Check with ps immediately before sending a signal as root.

Filed under

Process & service management

Read alongside

psTakes a snapshot of the running processes — who owns each, its process ID, and how much CPU and memory it is using.systemctlControls systemd services — start, stop, restart, enable at boot — and reports the state of each one.