Killing processes

Table of Contents

Understanding When and Why to Kill Processes

Killing a process means sending it a signal that tells it to stop doing what it’s doing—often to end it. You normally do this when:

A program is frozen or unresponsive
A process is using too much CPU or memory
You started the wrong command and want to stop it
You want to gracefully restart a service (stop, then start again)

In Linux, you don’t “kill” by name alone; you send signals to processes identified by a PID (process ID) or sometimes by name. How to see running processes is covered in the “Viewing processes” chapter; here we’ll focus on stopping them.

Signals Basics (What `kill` Actually Does)

The kill command doesn’t always “brutally” kill something. It sends a signal. The most common:

SIGTERM (15): “Please terminate gracefully.”

Gives the program a chance to clean up (save data, close files).
This is the default signal for kill.

SIGKILL (9): “Die now, no questions asked.”

Cannot be caught or ignored by the process.
Use only when gentler methods fail.

SIGINT (2): Same signal you send with Ctrl+C in a terminal.
SIGHUP (1): Traditionally “hang up”; often used to tell daemons to reload config or restart.

You can refer to signals by name (e.g. -SIGTERM, -TERM) or number (e.g. -15).

To see available signals on your system:

kill -l

The `kill` Command (By PID)

Basic usage

General syntax:

kill [options] PID...

Examples:

Gracefully ask a process to stop (default is SIGTERM):

  kill 1234

Explicitly send SIGTERM:

  kill -TERM 1234
  # or
  kill -15 1234

Forcibly stop (use as last resort):

  kill -KILL 1234
  # or
  kill -9 1234

You can kill multiple PIDs at once:

kill 1234 2345 3456

Finding the PID to kill

This is covered more deeply in “Viewing processes”, but quick examples:

Using ps:

ps aux | grep firefox

You’d then pick the correct PID from the output and:

kill 9876

Using pgrep (matches process names):

pgrep firefox
kill 9876

Or combine:

pkill -TERM firefox

(more on pkill below)

Killing Processes by Name: `pkill` and `killall`

Sometimes you don’t want to manually look up a PID; you’d rather kill “all firefox processes”.

`killall`

killall kills processes by exact name:

killall firefox

This sends SIGTERM to all processes named firefox. To force kill:

killall -KILL firefox
# or
killall -9 firefox

Common useful options (varies slightly by distribution):

-u username – kill processes owned by a specific user:

  killall -u alice firefox

-i – interactive, ask for confirmation before each kill:

  killall -i firefox

Warning: On some Unix-like systems, killall has different behavior (e.g., kill all processes). On typical Linux distributions it’s “kill by name”, but always check man killall on your system.

`pkill`

pkill is similar but more flexible; it can match patterns:

Kill by name:

  pkill firefox

Send a different signal:

  pkill -TERM firefox
  pkill -KILL firefox

Kill only processes owned by a specific user:

  pkill -u alice firefox

Match part of a command line (not just the binary name):

  pkill -f "python my_script.py"

As with killall, use with care: you might kill more than you intended if your pattern is too broad.

Stopping Foreground Programs (Keyboard Shortcuts)

When a program runs in the terminal foreground:

Ctrl+C – sends SIGINT to the current foreground process (often stops it).
Ctrl+Z – sends SIGTSTP (suspend), which pauses the process and returns you to the shell; fg can resume it in the foreground, bg in the background.

Use Ctrl+C as your first “stop” action for something you just started in the terminal.

Choosing the Right Signal

General guideline:

Ask nicely first: SIGTERM (or Ctrl+C if foreground).

Example:

     kill 1234
     # or
     killall firefox

If it doesn’t respond after a short wait, try again and check if the process is stuck (e.g., using ps, top, or htop).
As a last resort, use SIGKILL:

   kill -9 1234
   pkill -9 firefox

Why not jump to SIGKILL?

The process cannot cleanly shut down
Temporary files, locks, or corrupted data may be left behind
Services might not release resources properly

Permission Rules When Killing Processes

You can only send signals to:

Processes you own (same user), or
Any process if you are root (or using sudo).

If you see:

bash: kill: (1234) - Operation not permitted

That process is likely owned by another user or by root. You can:

sudo kill 1234

Use extra caution when killing processes as root; you can easily stop critical system services.

Killing Background Jobs from Your Shell

For commands started in the current shell:

List jobs:

  jobs

Output example:

  [1]+  Running    sleep 300 &

Kill by job number using %:

  kill %1

You can convert a job number to a PID (if you want):

ps
# or
ps -o pid,cmd

But kill %jobnumber is usually easier for quick, recent background jobs.

Being Safe and Selective

Before killing anything, especially as root:

Identify the process properly.

Use ps, ps aux | grep ..., pgrep, or tools like top/htop.

Check the command line to be sure it’s the right thing.
Avoid killing obvious system-critical processes (e.g. systemd, init, sshd, database servers) unless you know exactly what you’re doing.

For practice, you can safely experiment with harmless commands like:

sleep 1000 &
ps
kill <that PID>

This lets you see how kill behaves without risking your system.

Summary of Common Commands

Kill by PID (graceful):

  kill 1234

Kill by PID (force):

  kill -9 1234

Kill all by name (graceful):

  killall firefox
  pkill firefox

Kill all by name (force):

  killall -KILL firefox
  pkill -9 firefox

List signals:

  kill -l

Stop a foreground command:

Ctrl+C (interrupt/stop)
Ctrl+Z (suspend; use fg/bg afterwards)

Mastering these will let you recover from stuck programs and keep control over your system from the command line.

Comments

Please login to add a comment.

Don't have an account? Register now!