Linux · process & service management

pkill

stop a process by name

pkill finds processes by name and signals them in one step. Its partner pgrep does the finding without the killing, and is the way to check what a pattern will match before you use it.

Run pgrep -a pattern first. Whatever it lists is what pkill will signal.

Matches

Process names

as a pattern, not exactly

Default signal

TERM

a polite request to stop

Preview

pgrep -a

same matching, no signal

Whole command line

-f

not just the name

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashprocps

$ pgrep -a python

14127 python3 worker.py

4188 python3 -m http.server 8000

2$ pkill -f "http.server"

3$ pgrep -a python

4127 python3 worker.py

4$ pkill -u deploy

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

What the pattern matches

Two processes have "python" in their name. -a shows the full command line, so they can be told apart.

-f matches the whole command line

Both processes are named python3, so the name alone cannot separate them. -f matches against the arguments too.

One left

The web server is gone; the worker is untouched. pkill printed nothing, which means it found and signalled a match.

Every process of one user

-u matches by owner instead of name. This signals everything the deploy account is running.

Switches

A switch changes how the command behaves. These are the ones used day to day; man pkill lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-f: Match against the full command line, not only the process name.
-x: Match the name exactly, not as part of a longer name.
-u USER: Match only processes owned by this user.
-SIGNAL: Send this signal instead of TERM: -9, -HUP, -STOP.
-n: Match only the newest matching process. -o matches the oldest.
-e: Echo: print what was killed.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

pkill -9 firefox

Sends KILL, for a process that ignores the polite request.

pkill -HUP nginx

Sends HUP, which asks many services to re-read their configuration.

pgrep -c sshd

Counts the matching processes.

killall -v chrome

A similar tool that matches the exact name only.

In cybersecurity

A pattern matches more than you had in mind more often than not.

Loose patterns

"pkill ssh" also matches sshd and ssh-agent, and can cut your own connection. Use -x for an exact name, and preview with pgrep.

As root there is no limit

An ordinary user can only signal their own processes. Root can signal anything, including the init process and the database.

Stopping security tools

Killing the logging or monitoring agent is an early step in many intrusions. An agent that stops unexpectedly deserves an alert of its own.

Filed under

Process & service management

Read alongside

killSends a signal to a process — by default a polite request to finish, and with -9 an order the process cannot refuse.psTakes a snapshot of the running processes — who owns each, its process ID, and how much CPU and memory it is using.