Kill Commands in Linux is to terminate any unresponsive process.

As part of our Server Management Services, we assist our customers with several Linux queries.

Today, let us focus on how to simply kill the process when it becomes unresponsive or fails to respond.

 

What Is Process?

A process is the working mechanism of a program that is currently in execution. Upon its creation, every process automatically assigns to a unique process identification number, also known as a PID.

When a process dies, its PID returns to the pool of available PIDs, and another process can then reuse it.

We can use multiple commands on a server to find a specific PID of a process. We can use the top command, to find the PID of a process along with other useful system information.

Another way to find the PID is with the

psCopy Code

command:

[root@host ~]# ps faux | grep systemd
Root 1 0.0 0.6 96656 11260 ? Ss Jan24 0:08 /usr/lib/systemd/systemd –switched-root –system –deserialize 18
Root 533 0.0 1.3 125588 22832 ? Ss Jan24 0:25 /usr/lib/systemd/systemd-journald
Root 564 0.0 0.5 107440 9248 ? Ss Jan24 0:00 /usr/lib/systemd/systemd-udevd
Dbus 684 0.0 0.3 73540 5524 ? Ss Jan24 0:06 /usr/bin/dbus-daemon –system –address=systemd: –nofork –nopidfile –systemd-activation –syslog-only
Root 743 0.0 0.4 95736 7760 ? Ss Jan24 0:01 /usr/lib/systemd/systemd-logind
Root 66199 0.0 0.0 12108 1060 pts/0 S+ 08:28 0:00 \_ grep –color=auto systemd
Root 66153 0.0 0.5 93212 9472 ? Ss 08:27 0:00 /usr/lib/systemd/systemd –userCopy Code

[root@host ~]# ps -eo user,pid,command | grep systemd
[root@host ~]# ps -eo user,pid,command | grep systemd
root 1 /usr/lib/systemd/systemd –switched-root –system –deserialize 18
root 533 /usr/lib/systemd/systemd-journald
root 564 /usr/lib/systemd/systemd-udevd
dbus 684 /usr/bin/dbus-daemon –system –address=systemd: –nofork –nopidfile –systemd-activation –syslog-only
root 743 /usr/lib/systemd/systemd-logind
root 66153 /usr/lib/systemd/systemd –user
root 66213 grep –color=auto systemdCopy Code

We can also use the

pidofCopy Code

process_name, and the

pgrepCopy Code

process_name commands to find out the corresponding PIDs of that process.

[root@host ~]# pidof systemd
66156 66153 1Copy Code

[root@host ~]# pgrep systemd
1
533
564
743
66153Copy Code

To terminate a process, we can use the kill commands in Linux. This is a built-in command that sends a signal to a specified process, which terminates the process in question.

 

What Are Signals?

Signals are a form of a dialogue between the processes that can come from other processes, the kernel, or the process itself.

Each process has a current behavior, of which there are five dispositions:

• Term
• Ign
• Core
• Stop
• Cont

The Term’s default action is to terminate the process, and it is the one primarily used by the kill command.

There are a total of sixty-four (64) signals. The one we send will depend on the result that we want, as different signals have different effects and outcomes.

Out of these sixty-four signals, the first thirty-one are standard signals and the last thirty-three are real-time signals.

We can see a full list of available signals with the command

kill -lCopy Code

:

[root@host ~]# kill -l
1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL 5) SIGTRAP 6) SIGABRT
7) SIGBUS 8) SIGFPE 9) SIGKILL 10) SIGUSR1 11) SIGSEGV 12) SIGUSR2
13) SIGPIPE 14) SIGALRM 15) SIGTERM 16) SIGSTKFLT 17) SIGCHLD
18) SIGCONT 19) SIGSTOP 20) SIGTSTP 21) SIGTTIN 22) SIGTTOU 23) SIGURG 24) SIGXCPU 25) SIGXFSZ 26) SIGVTALRM 27) SIGPROF 28) SIGWINCH
29) SIGIO 30) SIGPWR 31) SIGSYS 34) SIGRTMIN 35) SIGRTMIN+1
36) SIGRTMIN+2 37) SIGRTMIN+3 38) SIGRTMIN+4 39) SIGRTMIN+5
40) SIGRTMIN+6 41) SIGRTMIN+7 42) SIGRTMIN+8 43) SIGRTMIN+9
44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12 47) SIGRTMIN+13
48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14 51) SIGRTMAX-13
52) SIGRTMAX-12 53) SIGRTMAX-11 54) SIGRTMAX-10 55) SIGRTMAX-9
56) SIGRTMAX-8 57) SIGRTMAX-7 58) SIGRTMAX-6 59) SIGRTMAX-5
60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2 63) SIGRTMAX-1
64) SIGRTMAXCopy Code

For most of these signals, a program may or may not specify a different action. If it defines, it is called catching or handling the signal, but if no action occurs, then the signal will be ignored.

The most commonly used signals are:

Signal Name            Single Value    Effect
SIGHUP                 1               Hangup, reload a process
SIGINT                 2               Interrupt from keyboard
SIGKILL                9               Kill a process
SIGTERM                15              Terminate a process gracefully
SIGSTOP                17, 19, 23      Stop a processCopy Code

We can use SIGKILL when SIGTERM fails to stop or end the process.

[root@host ~]# ps -eo user,pid,command | grep java
tomcat 59815 /usr/bin/java -Djava.util.logging.config.file=/usr/local/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat9/bin/bootstrap.jar:/usr/local/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat9 -Dcatalina.home=/usr/local/tomcat9 -Djava.io.tmpdir=/usr/local/tomcat9/temp org.apache.catalina.startup.Bootstrap start
root 66401 grep –color=auto java
[root@host ~]# kill -15 59815Copy Code

Unfortunately, the kill -15 (SIGTERM) did not accomplish stopping the Java process.

[Want to know more? Contact us now]

Kill Commands In Linux

The kill command sends a signal to terminate a process. By default, it will send a TERM signal. It will try to stop the process gracefully. If that fails, we can try terminating the process with another signal.

To kill a process with a different signal, it can be defined using a number (-9), with a SIG prefix (-SIGkill) with or without the SIG prefix (-kill).

[root@host ~]# ps -eo user,pid,command | grep java
tomcat 66469 /usr/bin/java -Djava.util.logging.config.file=/usr/local/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat9/bin/bootstrap.jar:/usr/local/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat9 -Dcatalina.home=/usr/local/tomcat9 -Djava.io.tmpdir=/usr/local/tomcat9/temp org.apache.catalina.startup.Bootstrap start
root 66516 grep –color=auto java
[root@host ~]# kill -9 66469
[root@host ~]# ps -eo user,pid,command | grep java
root 66530 grep –color=auto javaCopy Code

As we can see, the kill -9 (SIGKILL) command terminates the Java process.

The kill command can be invoked with the following syntax:

kill [OPTIONS] [PID]Copy Code

For example, if we find that the process ID for a httpd process is 21567, we can try to kill it gracefully by invoking:

[root@host ~]# kill 21567Copy Code

This will send the TERM signal. If this does not stop the process, we can then try to kill it with the signal SIGKILL (-15).

We can accomplish it in one of the following ways:

[root@host ~]# kill -9 21567
[root@host ~]# kill -SIGKILL 21567
[root@host ~]# kill -kill 21567Copy Code

 

Killall

Additionally, we can kill a process by using the unique process ID, by using the kill command, or with the process name, by using the

killallCopy Code

command.

The same syntax applies with the

killallCopy Code

command, which can invoke with

killallCopy Code

[signal] [process_name], for example:

killall -9 httpdCopy Code

This command will terminate the

httpdCopy Code

process without waiting for it to stop gracefully. When determining which process the signal will be sent to, it will match the argument name exactly.

For example:

killall httpdCopy Code

The command will send a termination signal to all processes that are exactly named “

httpdCopy Code

.”

Instead, if we try to run this command:

killall httpCopy Code

It will show an error that there is no process with that name since Apache uses “

httpdCopy Code

” and not “

httpCopy Code

.”

 

Pkill

A command similar to

killallCopy Code

is

pkillCopy Code

, which also can kill a process by name. This command takes a pattern as an argument, which matches against the names of running processes, so it does not need an exact name.

For example, we can terminate

httpdCopy Code

with something like this:

pkill httpCopy Code

Although this is not the exact process name, it will find the processes that contain this pattern and send the terminate signal to

httpdCopy Code

.

 

Skill

We can use the

skillCopy Code

command to send termination signals, much like kill command. Here it uses the default TERM signal.

skill [signal] [options]

[root@host ~]# ps -eo user,pid,command | grep tomcat
tomcat 66546 /usr/bin/java -Djava.util.logging.config.file=/usr/local/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat9/bin/bootstrap.jar:/usr/local/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat9 -Dcatalina.home=/usr/local/tomcat9 -Djava.io.tmpdir=/usr/local/tomcat9/temp org.apache.catalina.startup.Bootstrap start
root 66846 grep –color=auto tomcat
[root@host ~]# skill -9 66546Copy Code

Our Support Techs suggest using the

killCopy Code

,

pkillCopy Code

, or

killallCopy Code

commands instead.

 

Mysql_zap

Another command that will end a process that matches a specific pattern is

mysql_zapCopy Code

. An identified process will match this pattern if its output line from the ps command contains that pattern.

As with other commands,

mysql_zapCopy Code

will send a TERM signal by default. The syntax used for this command is:

[root@host ~]# mysql_zap [signal] [pattern].Copy Code

We should note that the

mysql_zapCopy Code

command depreciates in MariaDB as of version 10.2 in favor of the

pkillCopy Code

command.

 

Mk-kill

The

mk-killCopy Code

command is to kill MySQL queries that match a specific criterion.

If a file pass to

mk-killCopy Code

, it will read the queries from that file, which contain the output of SHOW PROCESSLIST.  If no file is given as an argument,

mk-killCopy Code

will execute a SHOW PROCESSLIST in MySQL to obtain the queries.

Here are two examples of that command:

[root@host ~]# mk-kill –busy-time 60 –print
[root@host ~]# mk-kill –match-command Sleep –kill –no-only-oldest –interval 10Copy Code

The first command will kill any queries found to be running longer than sixty seconds. The second command checks for any sleeping processes every ten seconds, and if any are found, the

mk-killCopy Code

command ends those queries.

 

Mkill

Another command similar to

mk-killCopy Code

is the

mkillCopy Code

command. This command will kill slow queries.

It will kill these queries based on several factors, such as query time, host, user, database, state, and query content. Note that the

mkillCopy Code

command is still in an alpha version status.

 

Tkill/Tgkill

If we want to kill a specific thread, instead of an arbitrary thread within an entire process, we can do so with

tkillCopy Code

and

tgkillCopy Code

commands.

We should note that the

tkillCopy Code

command should avoid as it is the depreciated predecessor to

tgkillCopy Code

. The

tkillCopy Code

command only allows for the target thread ID to be specified, which could lead to the termination of an incorrect thread if that thread ID is recycled.

On the other hand,

tgkillCopy Code

will send a signal to the thread with the thread ID in the thread group

tgidCopy Code

.

 

Killpg

It is also worth noting that several commands are to send signals to a process group. One of those commands is

killpgCopy Code

.

The

killpgCopy Code

command will send a signal to a process group (or

pgrpCopy Code

). If the

pgrpCopy Code

is 0, then a signal will be sent to the calling process’ process group.

Otherwise, the

killpgrpCopy Code

command does not take any other arguments so that it will kill all processes within the same process group.

 

Tcpkill

We can also kill specific TCP connections that are in progress with the

tcpkillCopy Code

command. We can specify a network interface to listen on, or we can also determine the degree of force to use in terminating a connection, where the default is

3Copy Code

.

The following command is the syntax of

tcpkillCopy Code

.

[root@host ~]# tcpkill [-i interface] [-1…9] expression
[root@host ~]# tcpkill -i eth0 port 21Copy Code

 

Lxc-kill

If we need to stop a process running inside a virtualized container running on Ubuntu, we can use the

lxc-killCopy Code

command. This command will send a numeric signal to the first process of the container to end a process.

The syntax of the

lxc-killCopy Code

command is as follows:

lxc-kill –name=NAME SIGNUMCopy Code

 

Arckill

The

arckillCopy Code

command is to kill running jobs on an ARC enabled resource. We can either use the

jobidCopy Code

, or the jobname, if such an attribute was submitted, to refer to a job.

arckill -j filename.xml (<jobid#>)Copy Code

 

Pvm_kill

To terminate a specific PVM process, we can use the

pvm_killCopy Code

command. It will send a terminate signal to a PVM process that is identified by the task identifier

tidCopy Code

.

We use this command with a larger program:

In C: info = pvm_kill( tid );
In Fortran: CALL PVMFKILL( TID, INFO )Copy Code

 

Xkill

There is also the

xkillCopy Code

command, which is a graphical way to kill an application.

When we enter the command

xkillCopy Code

, the mouse cursor will change into a plus sign. It allows us to left-click an unresponsive window to close it. The

xkillCopy Code

command instructs the xserver to terminate the window displaying a program.

Its syntax is as follows:

xkill [-display displayname] [-id resource] [-button number] [-frame] [-all]Copy Code

[Finding it hard to execute a command? We’d be happy to assist]

 

General Rules of Kill Commands In Linux

It is essential to note that regular users can send signals to their own processes. However not to those that belong to other users.

The root user, on the other hand, can send signals to all other user’s processes.

This also depends on what PID we pass to the command:

• If the PID is greater than zero, then the signal sends to the process with that PID.
• When PID is equal to zero, the signal sends to all processes in the process group (PGID) of the shell that is invoking the kill command.
• If PID is equal to -1, the signal sends to all processes with the same user ID as the user who has invoked the kill command.
• If PID is less than -1, the signal sends to all processes in the process group with the process group ID that is equal to the absolute value of the PID.

[Confused with the rules? We’ll make it easy for you]

 

Conclusion

To conclude, there are several ways to terminate a process. However, one should exercise caution to prevent incorrectly terminating a process that should not be killed. Get in touch with our Support Engineers who will happily assist you in matters of Kill Commands In Linux.