Using kill, killall, and pkill

Shared

VPS

Dedicated

 

WP Professional

WP Professional Plus

The kill command is in the format of kill signal processid.
The kill and killall commands are used to kill the specified processes.

During this tutorial we will use the ps, more and the grep command. We will not cover the detailed usage of these commands but their usage should be self explanatory. Please see the relevant man pages for details.

What is a process?

A process is a running program in memory or part of a program. In its simplest form it is a complete program, however some programs such as Apache will spawn additional processes so that it can run many jobs in parallel across the multiple cores of the CPU. To help identify each process it is given a numeric ID starting with PID 1. PID 1 is the first process on a Linux server to be run and up until recently was always called init. This was the system initialization process and loaded all further programs.

To view a list of running processes you can use the command ps aux. The ps command lists running processes. You can safely play around with the three options a,u and x in different combinations. However ps aux gives you most details that you will require when managing a Linux system.

If you try this command and the list is too long for your screen you can pipe it to more like this ps aux | more.

If you want to filter the list use ps aux | grep [process name]. For example to see all apache processes use ps aux | grep apache or ps aux | grep httpd depending on what family of Linux you are using.

PSTREE

The ps command is a great command but sometimes as in the above case of Apache the parent process will have launched child processes using the same name. Sometimes you need to know the parent's process id (pid). The easiest way to do this is to use pstree -p. You can grep the output to show only the process you want to see by using pstree -p | grep httpd, which will result in something like this:

[root@plesk bare-theme]# pstree -p | grep httpd
        |-httpd(31632)-+-httpd(10978)
        |              |-httpd(10979)
        |              |-httpd(10980)
        |              |-httpd(10981)
        |              |-httpd(10982)
        |              |-httpd(10983)
        |              |-httpd(10984)
        |              |-httpd(10985)
        |              `-httpd(10986)

As you can see in this example the first line has two httpd(pid). The top left one is the one you would send the signal to.

Using pgrep

Another way of finding the correct process id is to use pgrep -l httpd. This gives a cleaner output than pstree on its own. However in some circumstances it is preferable to use the pstree and filter through grep. pgrep -l is a handy one to remember. pgrep is generally most useful when used in combination with pkill (see later in this tutorial)

Kill Signals

What kill actually does is send a signal to the process. It doesn’t actually kill it directly. The process is responsible for handling the signal. We will only look at a couple of signals in this tutorial. If you want to see the full list please use kill -l. If you want to get into the guts of signals please see man 7 signal however this is going well beyond the scope of this tutorial.

The signals we will look at are SIGHUP (1), SIGKILL (9) and SIGTERM(15)

SIGHUP

This signal (HUP) was originally used in the days of dial up modems to let the process know that the serial line had been Hung UP. Because signals were so useful and back then there were no user defined signals, some programs that didn’t require a terminal such as daemons would repurpose the HUP signal for other uses. This convention has been maintained to this day even though we now have custom signals available to us. The SIGHUP (1) signal is now used to tell a process to reload the configuration file and re-initialize. This is useful for services (Daemons) such as Apache. It is a much quicker way of restarting Apache with a new configuration. Using the results of the pstree as shown above we would issue the command kill -HUP 31632.

SIGTERM

The SIGTERM is the default signal sent by the kill command if you don’t provide a signal. For instance kill 31632. This is the polite way of asking a process or program to stop. It is the preferred signal as it gives the process the opportunity to clean up after itself and shut down nicely.

SIGKILL

The SIGKILL signal tells the process to terminate immediately. The only time a process will not be able to comply is if it is in the middle of a system call such as writing a file. However when it returns from the system call it should process any queued signal. The SIGKILL (9) can be called by either kill -KILL pid or kill -9 pid. This signal is a hard kill and will terminate pretty much all running processes. The exception is that Zombie processes will not be affected by this. A Zombie process is a process that has finished and exited but for some reason still has an entry in the process table.

KILLALL

The killall command does the same as the kill command however it takes the name of the process instead of the process id (pid). It will then kill all the processes that share this name. In the above example we could use killall httpd. When using killall you can also send signals using the following format killall -sKILL httpd. This is a powerful command so if you want to be certain that you are not killing anything that you shouldn’t be then use the -i interactive option killall -sKILL -i httpd. This will ask you y/n before killing each pid.

pkill

The pgrep and pkill commands allow you to search for a process and kill a process by using a partial process name. For example if you are running a script called very-long-script-name-that-you-cant-remember.sh and you want to kill it without using ps to find the pid or typing in the full script name into killall. To kill this script you could use pkill -9 very-long. pkill and pgrep have some very useful options which you can read more about at man pkill. The pkill command requires that the name you use is part of the first 15 characters of the process name.