The kill command is in the format of
kill signal processid.
The kill and killall commands are used to kill the specified processes.
The kill and killall commands are extremely powerful. If they are misused they can bring a server down. If you are new to these two commands it is recommended that you learn on a non production server.
During this tutorial we will use the
more and the
grep command. We will not cover the detailed usage of these commands but their usage should be self explanatory. Please see the relevant man pages for details.
What is a process?
A process is a running program in memory or part of a program. In its simplest form it is a complete program, however some programs such as Apache will spawn additional processes so that it can run many jobs in parallel across the multiple cores of the CPU. To help identify each process it is given a numeric ID starting with PID 1. PID 1 is the first process on a Linux server to be run and up until recently was always called init. This was the system initialization process and loaded all further programs.
To view a list of running processes you can use the command
ps aux. The
ps command lists running processes. You can safely play around with the three options
x in different combinations. However
ps aux gives you most details that you will require when managing a Linux system.
If you try this command and the list is too long for your screen you can pipe it to more like this
ps aux | more.
If you want to filter the list use
ps aux | grep [process name]. For example to see all apache processes use
ps aux | grep apache or
ps aux | grep httpd depending on what family of Linux you are using.
The ps command is a great command but sometimes as in the above case of Apache the parent process will have launched child processes using the same name. Sometimes you need to know the parent's process id (pid). The easiest way to do this is to use
pstree -p. You can grep the output to show only the process you want to see by using
pstree -p | grep httpd, which will result in something like this:
[root@plesk bare-theme]# pstree -p | grep httpd |-httpd(31632)-+-httpd(10978) | |-httpd(10979) | |-httpd(10980) | |-httpd(10981) | |-httpd(10982) | |-httpd(10983) | |-httpd(10984) | |-httpd(10985) | `-httpd(10986)
As you can see in this example the first line has two httpd(pid). The top left one is the one you would send the signal to.
Another way of finding the correct process id is to use
pgrep -l httpd. This gives a cleaner output than pstree on its own. However, in some circumstances, it is preferable to use the
pstree and filter through
pgrep -l is a handy one to remember.
pgrep is generally most useful when used in combination with
pkill (see later in this tutorial)
What kill actually does is send a signal to the process. It doesn’t actually kill it directly. The process is responsible for handling the signal. We will only look at a couple of signals in this tutorial. If you want to see the full list please use
kill -l. If you want to get into the guts of signals please see
man 7 signal however this is going well beyond the scope of this tutorial.
The signals we will look at are SIGHUP (1), SIGKILL (9) and SIGTERM(15)
This signal (HUP) was originally used in the days of dial-up modems to let the process know that the serial line had been Hung UP. Because signals were so useful and back then there were no user-defined signals, some programs that didn’t require a terminal such as daemons would repurpose the HUP signal for other uses. This convention has been maintained to this day even though we now have custom signals available to us. The SIGHUP (1) signal is now used to tell a process to reload the configuration file and re-initialize. This is useful for services (Daemons) such as Apache. It is a much quicker way of restarting Apache with a new configuration. Using the results of the pstree, as shown above, we would issue the command
kill -HUP 31632.
The SIGTERM is the default signal sent by the kill command if you don’t provide a signal. For instance, kill 31632. This is the polite way of asking a process or program to stop. It is the preferred signal as it gives the process the opportunity to clean up after itself and shut down nicely.
The SIGKILL signal tells the process to terminate immediately. The only time a process will not be able to comply is if it is in the middle of a system call such as writing a file. However, when it returns from the system call it should process any queued signal. The SIGKILL (9) can be called by either
kill -KILL pid or
kill -9 pid. This signal is a hard kill and will terminate pretty much all running processes. The exception is that Zombie processes will not be affected by this. A Zombie process is a process that has finished and exited but for some reason still has an entry in the process table.
The killall command does the same as the kill command however it takes the name of the process instead of the process id (pid). It will then kill all the processes that share this name. In the above example we could use
killall httpd. When using killall you can also send signals using the following format
killall -sKILL httpd. This is a powerful command so if you want to be certain that you are not killing anything that you shouldn’t then use the -i interactive option
killall -sKILL -i httpd. This will ask you y/n before killing each pid.
pkill commands allow you to search for a process and kill a process by using a partial process name. For example, if you are running a script
called very-long-script-name-that-you-cant-remember.sh and you want to kill it without using ps to find the pid or typing in the full script name into
killall. To kill this script you could use
pkill -9 very-long. pkill and pgrep have some very useful options which you can read more about at
man pkill. The pkill command requires that the name you use is part of the first 15 characters of the process name.