LINFO

The kill Command

The kill command is used on Linux and other Unix-like operating systems to terminate processes without having to log out or reboot (i.e., restart) the computer. Thus, it is particularly important to the stability of such systems.

A process, also referred to as a task, is an executing (i.e., running) instance of a program. Each process is automatically assigned a unique process identification number (PID) when it is created for use by the system to reference the process.

The syntax for kill is

kill [signal or option] PID(s)

The only argument (i.e., input) that is required is a PID, and as many PIDs as desired can be used in a single command. Typically no signal or option is used.

Thus, if it is desired to terminate a process with a PID of 485, the following will usually be sufficient:

kill 485

The kill command has a misleading name because it does not actually kill processes. Rather, it sends signals to them. Each process is supplied with a set of standard signal handlers by the operating system in order to deal with incoming signals. When no signal is explicitly included in the command, signal 15, named SIGTERM, is sent by default. If this fails, the stronger signal 9, called SIGKILL, should be used. For example, the following command would nearly guarantee that process 485 would be killed:

kill -9 485

The only situation in which signal 9 will fail is if the process is in the midst of making a system call, which is a request to the kernel (i.e., the core of the operating system) for some action such as process creation. In this situation, the process will die once it has returned from the system call.

There are more than 60 signals that can be used with kill, but, fortunately, most users will only need to be aware of signal 9. The full list is contained in the file /usr/include/linux/signal.h and can be viewed by using kill with its -l option, i.e.,

kill -l

Obvious signs of misbehaving processes are programs that crash (i.e., appear to freeze or otherwise stop operating as expected) or that cannot be shut down normally (e.g., by clicking on a button or using using a menu command). The first step in such situation is to obtain the PID(s) of the offending process(es). This can often be accomplished with the help of the ps command, usually with its -a, -u and -x options (which tell it to list all processes and provide detailed information about them), i.e.,

ps -aux | less

As the list of processes can be quite long, the output of ps -aux can be piped (i.e., transferred) to the less command, which lets it be viewed one screenful at a time. The list can be advanced one screen forward by pressing the SPACE bar and one screen backward by pressing the b key.

Often it is obvious which is the offending process. However, sometimes it is not, particularly when the running of a program involves multiple processes, and thus it might be necessary to terminate several processes in order to close the offending program.

The pstree command can also be a useful tool for finding offending processes. This is because it displays the names of all processes on the system in the form of a tree diagram, thereby showing all of their parent/child relationships. When used with its -p option, pstree also shows the PIDs of the processes, i.e.,

pstree -p | less

pstree can simplify terminating a series of related processes (i.e., a process and all of its descendants) because it makes it immediately clear which process is the parent; all that is necessary is to kill the parent in order to also terminate all of its descendant processes. That is, it is not necessary to manually search through a list of processes to find and individually terminate each one as would be necessary using ps.

Because Unix-like operating systems and many of their application programs are inherently very robust (i.e., stable and resistant to crashing), it is not necessary to use the kill command as often as it is to terminate programs or reboot on some other operating systems. However, it does occasionally come in quite handy.

Despite its usefulness, however, there are situations in which the kill command even with its strongest signal is insufficient to terminate a process and rescue a frozen system or in which it is difficult to determine what is the offending process (or processes). In such case it is often easier to just reboot the system.