How to Kill a Process in Linux
In an operating system, there are many programs, which may be either run by an user or by the OS itself (such as system services). Such programs which are running on the system are called “processes”. Usually, a process terminates on its own when they’re done with their task, or when you ask them to quit by pressing a keyboard shortcut or clicking on the “Close” button.
However, sometimes a process can hang up or consume a lot of CPU or RAM. In this situation, you would want to manually “kill” the process. In this article, we will look at various tools you can use to kill processes on a Linux system.
Locating the process to kill
In order to kill a process, you should first locate the details of the process. You can do this through three commands — top, ps, pidof and pgrep. Depending upon the situation, you can use one of these commands for this purpose.
As we will see later in this article, you can kill a process by its name or its process ID (PID). The PID is a number that uniquely identifies a process. Killing by the process ID is useful when you want to kill only a specific process. On the other hand, killing by the process name is useful when you want to kill all running instances of a particular program.
Locating the process with the top command
We will first look at the top command. Fire up the top command by typing:
top
You will get an interactive interface, as shown below. You can browse through this list to find the name or the PID of the process you want to kill.
To browse through this list, you can use the up/down keys. Additionally, the top command also has ways to filter processes by CPU usage, user and process names, which you can read about in this guide.
The leftmost column contains the PID of the process, and the right side contains the program name. As an example, in the above screenshot we have the vnstatd process running with a process ID of 263.
Locating the process with ps and grep commands
Another way to get a list of process is by running:
ps aux
In the above command, we have used the flags aux which have the following meanings:
a: Show processes for all usersu: Display the user who is using the processx: Show all processes. (Without this,pswon’t show processes running in a GUI environment.)
The output of the command is similar to that of top. The PID is available in second column from the left, and the process name is available on the rightmost column.
The advantage of using ps is that you can easily filter this list with the grep command. For example, to find a process associated with the term “vnstat”, you can use:
ps aux | grep -i vnstat
Here, we got two results — the vnstatd process, as well as the grep process. Since we were searching for all instances of the term “vnstat”, and we were also running grep with “vnstat” as its argument, we got grep as well in the results.
Thus, even when there are no “vnstat” related processes running, we would get one entry showing the grep process:
So, even though we got a result, there are no processes that are of interest to us.
Finding the PID with pidof and pgrep
The top and ps/grep combination allows us to search for processes. On the other hand, if you know the exact name of a process, you can use pidof to find its PID.
Using pidof is pretty straightforward. To get the PIDs of a process with the exact name of “nginx”, use:
pidof nginx
If there are processes with the exact name of “nginx”, you will get a list of PIDs, as shown below. If there are none, you will get nothing as the output.
If you don’t know the full name, you can use pgrep instead of pidof. As an example, to search for all processes that contain “ngin” somewhere in their name, run:
pgrep ngin
This will match processes with the exact name of “nginx”, as well as any other process that matches the same criteria. For our system, notice that we get all the PIDs that belonged to “nginx” in the above screenshot.
The pidof andpkill commands give you far less information. As we shall see in the next section, there are some circumstances in which you can’t kill a process. The output of top and ps contain additional information that help you determine if you can really kill a process.
What processes can you kill?
Now that we have located the process, it is time to kill it. However, before we learn how to do so, there are a few things you need to know.
If you are a normal user, you can kill your own processes, but not those that belong to other users. Both top and ps show the user under which a process is running. In the case of top, the second column contains the username. With ps aux, the first column contains the username.
However, a root user can kill all processes. You can either add sudo before any command to run it as root, or obtain a root shell by typing su, and then execute the command.
In Linux, when a process is killed, a “terminating signal” is delivered to the process. Although there are many different types of signals, we mostly deal with the “SIGTERM” and “SIGKILL” signals. They have a numeric value of 15 and 9 respectively. By default, all the process killing commands use “SIGTERM”, which allows the program to run some code before it exits, thus allowing it to terminate “gracefully”. If you want to terminate the process forcibly, you can use “SIGKILL” instead.
The Linux kernel maintains some information related to the state of a process. When a process terminates, the kernel must keep the information around, so that the parent process can find out if the child process was able to complete its tasks and whether it terminated on its own, or it was killed. Until the parent has done so, these “zombie” processes will appear in the list of processes. You can’t kill such a process because it’s just an entry in the list of all processes, and it doesn’t have an actual process associated with it.
When a process performs input/output operations (such as reading from or writing to disks), it is said to be in a state of “uninterruptible sleep”. You can’t kill a process while it is in this state.
You can tell if a process is in the “zombie”(Z) or “uninterruptible sleep”(D) state by looking at the 8th column of the top/ps output.
Killing a process
There are various commands you can use to kill a process — kill, killall, pkill and top. We will begin from the simplest one: the killall command.
Killing processes with the killall command
The killall command is one of the easiest ways to kill a process. If you know the exact name of a process, and you know that it’s not running as another user and it is not in the Z or D states, then you can use this command directly; there’s no need to manually locate the process as we described above.
By default, For example, to kill a process named “firefox”, run:
killall firefox
To forcibly kill the process with SIGKILL, run:
killall -9 firefox
You can also use -SIGKILL instead of -9.
If you want to kill processes interactively, you can use -i like so:
killall -i firefox
If you want to kill a process running as a different user, you can use sudo:
sudo killall firefox
You can also kill a process that has been running for a certain period of time with the -o and -y flags. So, if you want to kill a process that has been running for more than 30 minutes, use:
killall -o 30m <process-name>
If you want to kill a process that has been running for less than 30 minutes, use:
killall -y 30m <process-name>
Similarly, use the following abbreviations for the respective units of time:
| s | seconds |
| m | minutes |
| h | hours |
| d | days |
| w | weeks |
| M | months |
| y | years |
Killing processes with the pkill command
Sometimes, you only know part of a program’s name. Just like pgrep, pkill allows you to kill processes based on partial matches. For example, if you want to kill all processes containing the name apache in the name, run:
pkill apache
If you want to use a SIGKILL instead of a SIGTERM, use:
pkill -9 apache
Again, you can also use -SIGKILL instead of -9.
Killing processes with the kill command
Using the kill command is straightforward. Once you have found out the PID of the process that you want to kill, you can terminate it using the kill command. For example, if you want to kill a process having a PID of 1234, then use the following command:
kill 1234
As we mentioned previously, the default is to use a SIGTERM. To use a SIGKILL, use -9 or -SIGKILL as we have seen before:
kill -9 1234
Killing processes with the top command
It is very easy to kill processes using the top command. First, search for the process that you want to kill and note the PID. Then, press k while top is running (this is case sensitive). It will prompt you to enter the PID of the process that you want to kill.
After you enter the PID, press enter. Now it will ask which signal you want to use to kill the process. If you want to use SIGTERM(15), then simply press enter as it is the default signal. If you want to use SIGKILL(9), then type 9 and press enter.
If you leave the process ID blank and hit enter directly, it will terminate the topmost process in the list. You can scroll using the arrow keys, and change the process you want to kill in this way.
Conclusion
In this post, we saw the various ways to kill processes in Linux. Learning these commands is essential for proper system administration and management. If you want to explore more of those commands, have a look at their respective man pages.
