VMware ESXi and vSphere Cluster Management

How to Kill a Process in Linux

Learn how Linux processes and PIDs work, how to find a process with top, ps, or pgrep, and how to stop it safely with kill, pkill, and killall.

What Is a Linux Process?

A process is an executing instance of a program. Every running program is represented by one or more processes. For example, opening a text editor creates a process for the editor, while a web browser may create several processes for its main window, tabs, and helper tasks.

Linux assigns each process a process ID (PID). The PID is a numeric identifier used to inspect or signal one particular process.

Normally, an application exits because it finishes its work, the user closes it, or the program chooses to shut down. When you use a command such as kill, you are externally sending a request or control signal to the process. The process may handle that signal and exit cleanly, pause, reload configuration, or terminate immediately depending on the signal and the application.

What the kill Command Does

The name kill is slightly misleading: it does not inherently force a process to stop. It sends a signal, which is a control message delivered to a process.

Basic syntax:

kill [signal] PID

If you omit the signal, kill sends SIGTERM, signal number 15. You can target more than one PID in a single command:

kill 13203 13218 13225

You can write a signal symbolically or numerically. These commands send the same signal:

kill 13203
kill -TERM 13203
kill -15 13203

To see the signal names and numbers recognized on your system, use:

kill -l

Signals and Graceful Termination

SIGTERM: The Normal First Attempt

SIGTERM means “please terminate.” It gives the application an opportunity to close files, flush pending data, release resources, remove temporary files, and run its shutdown handling. A program may exit immediately or may need a short time to finish cleanup.

These commands explicitly request graceful termination:

kill 13203
kill -TERM 13203
kill -15 13203

Application support determines how most catchable signals are handled. A well-behaved application can catch SIGTERM and perform custom cleanup before exiting, although it may also delay or ignore the request.

Common Linux Signals for Process Control

Signal name | Number | Typical purpose | Can the process handle or ignore it? | Safety notes

SIGHUP | 1 | Often asks a daemon or service to reread its configuration. Behavior depends on the program. Usually catchable; consult the service documentation. It is not a universal reload command.

SIGTERM | 15 | Requests normal termination. Usually catchable and handleable. Use this before SIGKILL so the program can clean up.

SIGKILL | 9 | Stops a process immediately. The target cannot catch, ignore, or clean up in response to it. Use only when a normal termination request fails.

SIGSTOP | — | Suspends a process without terminating it. It cannot be caught or ignored. The process remains present while stopped.

SIGCONT | — | Resumes a process stopped by SIGSTOP or another stop mechanism. Its effect depends on whether the process is currently stopped.

Forcefully Stopping a Process with SIGKILL

SIGKILL is signal 9. It stops the target immediately, and the target process cannot catch it, ignore it, or run cleanup code in response.

kill -KILL 13203
kill -9 13203

The symbolic and numeric forms above are equivalent. Try SIGTERM first whenever possible. SIGKILL can cause incomplete writes, corrupt application state, leftover temporary files, unreleased locks, or data loss because the program receives no opportunity to shut down normally.

Pausing, Resuming, and Reloading

Not every signal terminates a process. For example, you can temporarily suspend and later resume a process:

kill -STOP 13203
kill -CONT 13203

A stopped process remains in the process list. SIGCONT resumes it; it does not restart a process that has already exited.

Some services use SIGHUP to reload configuration:

kill -HUP 2450

Whether this works depends entirely on the service. Read the service documentation before assuming SIGHUP means reload.

Finding a Process PID

Use top

top is an interactive process monitor. It displays process IDs, owners, CPU and memory usage, and command names. Start it with:

top

Look for the process using excessive CPU or the process that appears unresponsive. Note its PID and command name. Press q to leave top.

htop is an optional, more interactive alternative when installed:

htop

Use ps

ps lists process status and details. This command includes ownership and full command information:

ps -ef

To look for a command such as dd while avoiding a match against the grep command itself:

ps aux | grep '[d]d'

Use pgrep

pgrep finds PIDs by process name. The -a option also displays the matching command line:

pgrep -a firefox

Always review the output. A name can match several processes, and a process name alone may not tell you whether it is the intended instance.

Commands for Finding and Stopping Processes

Command | Use case | Selection method | Important caution

top | Interactive inspection of CPU, memory, PIDs, and commands. Selection is manual from the process display. Confirm the PID before acting.

ps | Detailed or filtered process listings. Selection is based on options and shell filters. Confirm the owner and complete command line.

pgrep | Find matching PIDs and optionally show command lines. Selection uses process-name or pattern matching. Preview matches before sending a signal.

kill | Send a signal to one or more PIDs. Selection is by explicit PID. A wrong PID can affect an unrelated process.

pkill | Send a signal to processes selected by name or other criteria. Selection uses a name or pattern. One pattern may match multiple processes.

killall | Signal processes by name where supported. Selection uses the process name. Behavior and matching options vary by operating system; check local documentation.

Safe Workflow for Terminating a Process

  1. Identify the process. Use top, ps, or pgrep.
  2. Confirm the target. Check the PID, owner, command name, and preferably the full command line.
  3. Send SIGTERM first. Use kill PID or kill -TERM PID.
  4. Check whether it exited. Run ps or pgrep again, or refresh top.
  5. Escalate carefully. If the verified process remains and graceful termination failed, use kill -KILL PID.
  6. Investigate recurring failures. Repeatedly killing a process treats the symptom. Check logs, resource exhaustion, bugs, storage problems, and service configuration to find the cause of repeated hangs.

Example: Stop a Known Process by PID

Suppose you have verified that PID 13203 belongs to the unresponsive program you want to stop.

kill 13203

Because no signal was specified, this sends SIGTERM. Allow a short time for the program to close cleanly. Then verify it:

ps -p 13203 -o pid=,user=,stat=,comm=

If the command produces no process row, the process exited. If it is still present, verify the PID and command again before using the fallback:

kill -KILL 13203

Afterward, check again with ps or refresh top.

Example: Find and Stop a CPU-Intensive Process

Start the monitor and locate the high-CPU process:

top

For example, you might see a process named dd with PID 13203. Do not act solely because a process uses CPU; confirm that it is the intended process and that stopping it is safe. Then send a graceful termination request:

kill 13203

Check whether it exited:

pgrep -a -f '(^|/)dd([[:space:]]|$)'

If it remains after you have confirmed the PID and considered possible data loss, use SIGKILL as a last resort.

Terminating Processes by Name

pkill

pkill sends a signal to processes selected by name or another matching criterion:

pgrep -a firefox
pkill -TERM firefox

Run pgrep -a first as a preview. The second command may send SIGTERM to multiple Firefox processes. Some systems support exact matching with -x:

pgrep -a -x firefox
pkill -TERM -x firefox

Check the local manual page because matching behavior and available options can vary.

killall

killall targets processes by name where supported:

killall firefox

Because implementations differ, check its local documentation before using it:

man killall

Name-based commands can stop more processes than intended. Use individual PIDs when precision matters.

Permissions and Ownership

Users can generally send signals to processes they own. A process owned by another user may require elevated privileges. Inspect ownership with:

ps -p 13203 -o pid=,user=,comm=

An Operation not permitted or similar permission error means your account is not allowed to send that signal to the target. If you are authorized to manage the process, use sudo cautiously:

sudo kill 13203

Confirm the PID and command before using sudo. Elevated privileges make it possible to stop critical system or service processes, which can disrupt other users or the operating system.

Troubleshooting

The Process Remains After kill PID

  • The process may still be handling SIGTERM. Wait briefly and check again.
  • You may have selected the wrong PID. Recheck with ps or pgrep.
  • The application may delay or ignore termination requests.
  • The process may be stuck in an uninterruptible kernel wait state, often associated with I/O.

After verification, use SIGKILL only if appropriate. If SIGKILL also has no visible effect, investigate storage I/O, mounts, hardware, and kernel-level conditions. A restart may eventually be required.

A Permission Error Appears

Check the process owner with ps. If another user owns it, use sudo only when authorized and only after confirming the target.

pkill or killall Stops Too Many Processes

The pattern may have matched multiple instances or may have been too broad. Preview with pgrep -a, narrow the pattern, use an exact-match option where supported, or target individual PIDs with kill.

The Service Starts Again Immediately

A service manager, supervisor, container runtime, or monitoring tool may be configured to restart the process. Identify the supervising service and manage the service through its management tool instead of repeatedly killing its child process.

Exam-Relevant Notes

  • kill sends a signal; it does not always force termination.
  • The default signal is SIGTERM, number 15.
  • SIGKILL is signal 9 and cannot be caught, ignored, or cleaned up by the target.
  • A PID is the numeric identifier of a running process.
  • top, ps, and pgrep help locate and verify processes.
  • pkill and killall use names or patterns and can affect multiple processes.
  • SIGSTOP pauses a process; SIGCONT resumes it.
  • SIGHUP is often used for configuration reloads, but the application decides what it does.
  • Use SIGTERM first and SIGKILL only as a verified last resort.

For related process-management concepts, see Linux process termination and control.