All You Need to Know About Linux Kill Command From Scratch

September 20, 2016 | By in LINUX COMMANDS
| Reply More

The kill command is used on linux and other Unix-like operating systems ( Solaris,  AIX, HP-Unix, Mac). It doesn’t matter which operating system you are using to terminate processes without having to log out or reboot the computer. A process, also referred to as a task, is an executing (i.e., running) instance of a program. Each process is automatically assigned a unique process identification number (PID) when it is created for use by the system to reference the process.

The syntax for kill is

kill [signal or option] PIDNumber

The only argument (i.e, input) that is required is a PID, and as many PIDs as desired can be used
in a single command. The kill command will kill a process using the kill signal and PID given by the user

[shaha@oc8535558703 ~]$ sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[1] 13452

[shaha@oc8535558703 ~]$ jobs
[1]+ Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &

[shaha@oc8535558703 ~]$ jobs -l 1
[1]+ 13452 Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &

[shaha@oc8535558703 ~]$ kill -9 13452

The killall command kills all process with a particular name , if Firefox or java program is running in multiple
and the user does not know the PID, use the killall command - "killall -9 firefox or killall -9 java “

[shaha@oc8535558703 ~]$ ps
PID TTY TIME CMD
13156 pts/0 00:00:00 bash
13309 pts/0 00:00:00 sh
13310 pts/0 00:00:05 java
13452 pts/0 00:00:00 sh
13453 pts/0 00:00:05 java
[shaha@oc8535558703 ~]$
[shaha@oc8535558703 ~]$ killall java
[shaha@oc8535558703 ~]$

Some points to remember about Signals

• Linux supports both POSIX reliable signals ("standard signals") and POSIX real-time signals.

• A signal is nothing but some sort of inter-process communication (techniques for the exchanging data among multiple threads in one or more processes or commands)in Linux and Unix like operating systems.

• A signal is sent to a process or command in order notify an event that occurred.

• For example, while running a command called 'ls -R /, you may hit CTRL+C (or Break) to cancel command execution. As soon as you hit CTRL+C, a signals called SIGINT (2) sent to indicate interrupt from keyboard. When, SIGINT is sent to ls command, Linux interrupts the process's normal flow of execution. In this example, ls command get terminated.

• However, you can register a signal handler for CTRL+C and take some sort of action like ignore it or display a message on the screen when ls command is interrupted by SIGINT.

• You need to use the trap command to catch signals and handle errors under Linux shell scripts.

• You can send various signals to commands and process. For example, to terminate foreground process you can hit Ctrl+C key combination. To kill background process you can use the kill command and send SIGTERM (terminate command):

[shaha@oc8535558703 ~]$ kill -TERM pid
[shaha@oc8535558703 ~]$ kill -TERM 1234

Process - What it means for you ?

Linux is a multiuser (multiple users can login to Linux and share its resources) and multitasking operating
system. It means you can run multiple commands and carry out multiple tasks at a time.

For example, you can write a c program, while listening mp3s or download files using P2P in background. A process is program (or command typed by user) to perform specific Job. In Linux when you start a process, it is given a unique number called a PID or process-id. PIDs start from 0 to 65535.PID 1 is always assigned to init process, which is the first process started at boot time. Type the following command to verify that init always has PID 1

[root@oc8535558703 ~]# ps -C init -o pid=,cmd

Sample outputs:

CMD
1 /sbin/init

a) Parent and Child Processes

• A parent process is a Linux process that has created one or more child processes.

• A process can fork a child i.e create a child process.

• For example, if a user types the ls command at a shell prompt.

• The shell executes ls command.

• The Linux kernel will duplicate the shell's pages of memory and then execute the ls command.

• In UNIX, every process is created using fork and exec method. However, this model results in a waste of system resources.

• Under Linux, the fork method is implemented using copy-on-write pages, so the only penalty that it incurs is the time and memory required to duplicate the parent's page tables, and to create a unique task structure for the child.

• The copy-on-write model avoids creation of unnecessary copies of structures when creating new processes.

• For example, user types ls command at a shell prompt.

• The Linux kernel will fork and create a subprocess or child process of bash.

• In this example, bash is parent and ls command is child. In other words, the ls command is pointed to the same pages of memory as the bash shell.

• Then, the child execs the ls command using copy-on-write.

b) Process States

Every Linux process has its own life cycle such as creation, execution, termination, and removal.Every process has its own state that shows what is currently happening in the process. The status of the process which can be one of the following:

1. D (uninterruptible sleep) - Process is sleeping and cannot be bring back until an event such as I/O occurred. For example, process foo is a process waiting for keyboard interrupt.

2. R (running) - Process is running or executing.

3. S (sleeping) - Process is not running and is waiting for an event or a signal.

4. T (traced or stopped) - Process is stopped by signals such as SIGINT or SIGSTOP.

5. Z (zombie or defunct) - Processes marked are dead processes (so-called "zombies") that remain because their parent has not destroyed them properly. These processes will be destroyed by init if the parent process exits.

c) How do I view process states

To view states of a process, enter:

ps -C processName -o pid=,cmd,stat

For example, to display states of lighttpd, php-cgi and firefox-bin processes, enter:

[shaha@oc8535558703 ~]$ ps -C firefox-bin -o pid=,cmd,stat

[shaha@oc8535558703 ~]$ ps -C lighttpd -o pid=,cmd,stat

[shaha@oc8535558703 ~]$ ps -C php-cgi -o pid=,cmd,stat

Sample outputs:

CMD STAT
7633 /opt/firefox/firefox-bin Sl

CMD STAT

32082 /usr/sbin/lighttpd -f /etc/ S
32326 /usr/sbin/lighttpd -f /etc/ S

CMD STAT

1644 /usr/bin/php-cgi S
31331 /usr/bin/php-cgi S
31332 /usr/bin/php-cgi S
31538 /usr/bin/php-cgi S

d) How to view Processes

You need to use the ps command , pstree command , and pgrep command to view a snapshot of the
current process .

ps - View process To view current process use the ps command:

[root@oc8535558703 ~]# ps
PID TTY TIME CMD
15013 pts/2 00:00:00 su
15019 pts/2 00:00:00 bash
15169 pts/2 00:00:00 ps

[root@oc8535558703 ~]# ps aux | less
[root@oc8535558703 ~]# ps aux | grep "vmware"
root 2643 0.0 0.0 177256 972 ? Ssl 09:19 0:00 /usr/lib/vmware/bin/vmware-vmblock-fuse -o subtype=vmware-vmblock,default_permissions,allow_other /var/run/vmblock-fuse
root 2696 0.0 0.0 16836 5776 ? Ss 09:19 0:00 /usr/bin/vmnet-dhcpd -s 6 -cf /etc/vmware/vmnet1/dhcpd/dhcpd.conf -lf /etc/vmware/vmnet1/dhcpd/dhcpd.leases -pf
[root@oc8535558703 ~]# ps aux | grep "httpd"
root 15187 0.0 0.0 103308 868 pts/2 S+ 10:26 0:00 grep httpd
[root@oc8535558703 ~]# ps aux | grep "mysqld"
root 15189 0.0 0.0 103308 868 pts/2 S+ 10:26 0:00 grep mysqld
[root@oc8535558703 ~]#

pstree - Display a tree of processes

[root@oc8535558703 ~]# pstree
init─┬─BESClient─┬─XBESClientUI───2*[{XBESClientUI}]
│ └─5*[{BESClient}]
├─NetworkManager───{NetworkManager}
├─acpid
├─agnLogd
├─agnclientd───{agnclientd}
├─atd
├─auditd───{auditd}
├─automount───4*[{automount}]
├─blue-coat-unifi───32*[{blue-coat-unif}]
├─bluetoothd
├─bonobo-activati───{bonobo-activat}
├─ciscod
├─clock-applet
├─console-kit-dae───63*[{console-kit-da}]
├─crond
├─cups-ipm-confid
├─cupsd
├─3*[dbus-daemon───{dbus-daemon}]
├─3*[dbus-launch]
├─

e) Sending signal to Processes

You can send various signals to commands / process and shell scripts using the, pkill command, kill command, and killall command.

kill - send a signal to a proces

The default signal for kill is TERM. To list available signals, enter:

[shaha@oc8535558703 ~]$ kill -l

Sample outputs:

1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL 5) SIGTRAP
6) SIGABRT 7) SIGBUS 8) SIGFPE 9) SIGKILL 10) SIGUSR1
11) SIGSEGV 12) SIGUSR2 13) SIGPIPE 14) SIGALRM 15) SIGTERM
16) SIGSTKFLT 17) SIGCHLD 18) SIGCONT 19) SIGSTOP 20) SIGTSTP
21) SIGTTIN 22) SIGTTOU 23) SIGURG 24) SIGXCPU 25) SIGXFSZ
26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 29) SIGIO 30) SIGPWR
31) SIGSYS 34) SIGRTMIN 35) SIGRTMIN+1 36) SIGRTMIN+2 37) SIGRTMIN+3
38) SIGRTMIN+4 39) SIGRTMIN+5 40) SIGRTMIN+6 41) SIGRTMIN+7 42) SIGRTMIN+8
43) SIGRTMIN+9 44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12 47) SIGRTMIN+13
48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14 51) SIGRTMAX-13 52) SIGRTMAX-12
53) SIGRTMAX-11 54) SIGRTMAX-10 55) SIGRTMAX-9 56) SIGRTMAX-8 57) SIGRTMAX-7
58) SIGRTMAX-6 59) SIGRTMAX-5 60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2
63) SIGRTMAX-1 64) SIGRTMAX
[root@oc8535558703 ~]#

Few examples of kill command

The kill command can send all of the above signals to commands and process. However, commands only
give response if they are programmed to recognize those signals. Particularly useful signals include:

1. SIGHUP (1) - Hangup detected on controlling terminal or death of controlling process.
2. SIGINT (2) - Interrupt from keyboard.
3. SIGKILL (9) - Kill signal i.e. kill running process.
4. SIGSTOP (19) - Stop process.
5. SIGCONT (18) - Continue process if stopped.

To send a kill signal to PID # 1234 use:

[root@oc8535558703 ~]# kill -9 1234
OR
[root@oc8535558703 ~]# kill -KILL 1234
OR
[root@oc8535558703 ~]# kill -SIGKILL 1234

a) kill processes by name

killall command sends a signal to all processes running any of the specified commands . If no signal name is specified, SIGTERM is sent. To terminate all firefox process (child and parent), enter:

[root@oc8535558703 ~]# pgrep firefox
15989

[root@oc8535558703 ~]# ps -ef|grep -i firefox
shaha 15989 1 13 10:37 ? 00:00:02 /usr/lib64/firefox/firefox
root 16115 15019 0 10:37 pts/2 00:00:00 grep -i firefox

[root@oc8535558703 ~]# killall firefox

[root@oc8535558703 ~]# pgrep firefox

[root@oc8535558703 ~]# ps -ef|grep -i firefox
root 16126 15019 0 10:38 pts/2 00:00:00 grep -i firefox
[root@oc8535558703 ~]#

[root@oc8535558703 ~]# pgrep firefox
16141
[root@oc8535558703 ~]# ps -ef|grep -i firefox
shaha 16141 1 11 10:39 ? 00:00:02 /usr/lib64/firefox/firefox
root 16268 15019 0 10:39 pts/2 00:00:00 grep -i firefox
[root@oc8535558703 ~]# killall -s SIGKILL firefox
[root@oc8535558703 ~]# pgrep firefox
[root@oc8535558703 ~]# ps -ef|grep -i firefox
root 16287 15019 0 10:40 pts/2 00:00:00 grep -i firefox
[root@oc8535558703 ~]#

b) Kill all processes in Linux

The command killall5 -9 will forcefully terminate all running processes except your login shell, init, and kernel-specific processes. killall5 is the SystemV killall command. It sends a signal to all processes except the processes in its own session, so it won't kill the shell that is running the script it was called from. Its primary (only) use is in the rc scripts found in the /etc/init.d directory.

[shaha@oc8535558703 Desktop]$ killall5 -9

You can kill all of a given user's processes using one of these:

[shaha@oc8535558703 Desktop]$ killall -u username
or
[shaha@oc8535558703 Desktop]$ pkill -u username

or you can use the numeric UID instead of the username. Beware that killall functions differently (similarly to killall5) on some systems such as Solaris.

pkill - kill process

The pkill command is another command with additional options to kill process by its name, user name,group name,terminal, UID, EUID, and GID. It will send the specified signal (by default SIGTERM)
to each process instead of listing them on stdout. To send a kill signal to php-cgi process, enter:

[shaha@oc8535558703 ~]$ pkill -KILL php-cgi

The above example will kill all users php-cgi process. However, -u option will kill only processes whose effective user ID is set to shaha:

[shaha@oc8535558703 ~]$ pkill -KILL -u shaha php-cgi

Make sshd reread its configuration file, enter:

[shaha@oc8535558703 ~]$ pkill -HUP sshd

c) Terminating Processes

Generally, all process terminates on their own. In this example, find command will terminate when it completed its task:

[root@oc8535558703 ~]# find /home -name "*.c" 2>error.log 1>filelists &

You can terminate foreground process by pressing CTRL+C. It will send a TERM signal to the process.In this example, ls -R is running on screen:

[root@oc8535558703 ~]# ls -R /

To terminate simply press CTRL+C (hold down CTRL key and press C) to send an in interrupt signal to the ls command.  To terminate unwanted background process use kill command with -9 signal as described in sending signalto processes section:

[root@oc8535558703 ~]# kill -TERM pid
[root@oc8535558703 ~]# kill -KILL pid

To stop (suspend) a foreground process hit CTRL+Z (hold down CTRL key and press z).To resume the foreground process use the fg command, enter:

fg jobid
fg 1
fg %

[shaha@oc8535558703 ~]$ sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[1] 17565
[shaha@oc8535558703 ~]$ fg %1
sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
^Z
[1]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$ jobs
[1]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$ fg %1
sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh

d) Shell signal values

To view list of all signals, enter:

kill -l

To view numeric number for given signal called SIGTSTP, enter:

kill -l SIGTSTP

You can also view list of signal by visiting /usr/include/linux/signal.h file:

[shaha@oc8535558703 ~]$ more /usr/include/linux/signal.h

Show the status of all background and suspended jobs: jobs Bring a job back into the foreground: fg %jobnumber Bring a job back into the background: bg %jobnumber

[shaha@oc8535558703 ~]$ sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[1] 15131
[shaha@oc8535558703 ~]$
[shaha@oc8535558703 ~]$ jobs
[1]+ Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &

Make a foreground running process to run background without hang up , first process comes in stop condition with Ctrl+z keyboard then run bg %jobid

[shaha@oc8535558703 ~]$ sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
^Z
[2]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$ jobs
[1]- Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[2]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$

[shaha@oc8535558703 ~]$ bg %2
[2]+ sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[shaha@oc8535558703 ~]$ jobs
[1]- Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[2]+ Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[shaha@oc8535558703 ~]$

e) Make a background running process to foreground run without hang up

You can use the command jobs to obtain a list of your jobs, then you can use fg to bring that job to the front.
fg is the command to bring it back to the foreground as shown below.

[shaha@oc8535558703 ~]$ fg %1 %2
sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh

f) Kill all background running job

The following command gives you a list of all background processes in your session, along with the pid. You can then use it to kill the process.

[shaha@oc8535558703 ~]$ jobs
[1]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[2]- Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[shaha@oc8535558703 ~]$ jobs 1
[1]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$ jobs 2
[2]- Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[shaha@oc8535558703 ~]$ jobs -l 2
[2]- 15198 Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[shaha@oc8535558703 ~]$
[shaha@oc8535558703 ~]$ jobs -l 1 2
[1]+ 15131 Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[2]- 15198 Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &

[shaha@oc8535558703 ~]$ kill -9 15131 15198
[shaha@oc8535558703 ~]$ jobs
[1]+ Killed sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[2]- Killed sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$

g) Stop background Jobs

A "background job" is just one that is not interacting with the user, Control+Z is the most common default keyboard mapping for the key sequence that suspends a process. SIGSTOP signal used for stop a running background job .

[shaha@oc8535558703 ~]$ jobs -l [1]
[1]+ 18310 Running sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh &
[shaha@oc8535558703 ~]$
[shaha@oc8535558703 ~]$ kill -SIGSTOP 18310
[shaha@oc8535558703 ~]$ jobs
[1]+ Stopped sh /home/shaha/Documents/SametimeFileTransfers/ImE/ImE.sh
[shaha@oc8535558703 ~]$

h) How to find and kill a zombie process

You can find the zombie processes with ps aux | grep Z. The processes with Z in the STATE field are zombie processes:

[root@oc8535558703 ~]# ps aux | grep Z
or
[root@oc8535558703 ~]# ps -A -ostat,ppid | awk '/[zZ]/{print $2}'
3817
4720
4720
[root@oc8535558703 ~]#

To kill a zombie process, find the zombie’s parent PID (PPID) and send him the SIGCHLD (17) signal: kill -17 ppid I use this command to find a PPID: ps -p PID -o ppid

[root@oc8535558703 ~]# ps -p 20736 -o ppid
PPID
20735
[root@oc8535558703 ~]# kill -17 20735

or

kill $(ps -A -ostat,ppid | awk '/[zZ]/{print $2}')

Note: If you kill the parent of a zombie proceess, also the zombie process dies.

i) How to find and kill all sleep process

A process in S state is usually in a blocking system call, such as reading or writing to a file or the network, or waiting for another called program to finish.
You can use strace -p to find out which system call is currently happening. It will produce output like

[root@oc8535558703 ~]# ps -A -ostat,ppid | awk '/[sS]/{print $1 "\t" $2}'
STAT PPID
S 0
S 2
S 2
S 2

[root@oc8535558703 ~]# kill -9 $(ps -A -ostat,ppid | awk '/[Ss]/{print $2}')

j) How to find and kill a all STOP process

A stopped job is one that has been temporarily put into the background and is no longer running, but is still using resources such (i.e. system memory). Because that job is not attached to the current terminal, it cannot produce output and is not receiving input from the user.

[root@oc8535558703 ~]# ps -A -ostat,ppid | awk '/[T]/{print $1 "\t" $2}'
STAT PPID
T 18187
Tl 18310
[root@oc8535558703 ~]#
[root@oc8535558703 ~]# kill -9 $(ps -A -ostat,ppid | awk '/[T]/{print $2}')

Conclusion

The kill command is used on Linux and other Unix-like operating systems to terminate processes without having to log out or reboot (i.e., restart) the computer. Thus, it is particularly important to the stability of such systems.A process, also referred to as a task, is an executing (i.e., running) instance of a program. Each process is automatically assigned a unique process identification number (PID) when it is created for use by the system to reference the process.

Filed Under : LINUX COMMANDS, LINUX HOWTO

Free Linux Ebook to Download

Leave a Reply

Commenting Policy:
Promotion of your products ? Comment gets deleted.
All comments are subject to moderation.