Linux online course

Kill Processes by Name in Linux with killall

Learn how to safely stop Linux processes by name with killall, choose signals, inspect matches, use sudo, and verify that processes have exited.

A process is an active instance of a program running on a Linux system. Every process has a numeric process ID (PID) and a process name, usually derived from the executable or command that started it.

When you know the PID, you can send a signal with kill, such as kill 1234. When you want to select processes by their name instead, use killall. This is convenient, but it can affect several processes at once.

What killall does

killall sends an operating-system signal to every process whose name matches the name you provide. A signal is a notification used to request an action from a process, including graceful termination or forced termination.

The general form is:

killall [options] process_name

For example, this requests termination of every matching process named dd:

killall dd

On typical Linux implementations, the supplied name is matched exactly by default. Options can change the matching behavior, for example by making matching case-insensitive or by using a different selection rule. Available options and small details vary between Linux distributions and killall implementations, so check the local documentation with:

man killall

Inspect processes before stopping them

Use pgrep or ps to verify the process name, owner, PID, and command details before sending a signal.

pgrep -a dd

The -a option asks pgrep to show each matching PID together with its command line. An alternative using ps is:

ps -ef | grep '[d]d'

The bracket expression prevents the grep command itself from appearing as a match. Review the following information:

• PID: the numeric identifier used for a PID-based command.
• Owner: the user account running the process.
• Process name: the name that killall will match.
• Full command line: arguments and paths that can reveal what the process is actually doing.

The displayed command line is not always identical to the process name. A script may have an interpreter as its process name, an executable path may be shortened to its basename, and some tools display truncated names. If a command appears to be missing, inspect the process with ps or pgrep and use the exact name expected by the local killall implementation.

Default termination: SIGTERM

With no signal option, killall normally sends SIGTERM, signal number 15:

killall dd

SIGTERM is a request to terminate. A program can catch it, save state, close files, release resources, and exit cleanly. This is why SIGTERM should normally be the first attempt.

You can make the signal explicit with either its symbolic name or its number:

killall -s SIGTERM dd
killall -s 15 dd

Receiving SIGTERM does not guarantee that the process exits immediately. The application may need time to finish cleanup, may delay handling the signal, or may be unable to respond because it is stuck.

Forced termination with SIGKILL

SIGKILL, signal number 9, immediately forces a process to terminate. A process cannot catch, ignore, or handle SIGKILL:

killall -s 9 dd
killall -KILL dd

Use SIGKILL only after a normal termination request has failed and you understand the consequences. It does not give the application an opportunity to save data or perform cleanup. It can leave temporary files, incomplete output, or locked application state.

Other useful signals

Signal names are commonly written with or without the SIG prefix depending on the command syntax. Consult man killall if a particular form is rejected.

Every matching process is a target

A single killall invocation can signal all processes with the matching name. For example:

killall dd

If three dd processes are running, all three are candidates. This behavior is different from a PID-based command that identifies one particular process:

kill 1234

Multiple application instances may be intentional. A broad command can stop a terminal session, background worker, test process, or unrelated task merely because they share a name. Confirm the list with pgrep -a before running killall. If only one process should be stopped, use its PID with kill after verifying that PID.

Useful killall safety and selection options

Interactive mode is useful when several matches exist and you want to evaluate them one at a time:

killall -i dd

User filtering reduces the chance of affecting another account's process:

killall -u alice dd

Waiting can help scripts or administrators verify that termination has completed:

killall -w dd

Exact-name and case-insensitive options are implementation-dependent. On systems that provide them, an exact-name option can prevent a longer related name from being selected, while -I can match names without regard to uppercase and lowercase. Read the local manual page before relying on a particular option in a script.

Permissions and sudo

Linux normally allows a user to signal processes that the same user owns. Signaling a process owned by another user, especially a root-owned process, generally requires elevated privileges.

sudo killall dd

Use sudo only when you are authorized and have carefully reviewed the targets. Do not casually terminate critical system processes, security tools, service managers, or processes that maintain storage and networking. A root-owned process may be part of a larger system service, and stopping it can affect the whole machine.

Verify the result

After sending the signal, check whether matching processes remain:

pgrep -a dd

An empty result means that no matching process is currently reported. pgrep commonly returns a nonzero status when it finds no match, which is normal in this verification step.

You can also inspect the exit status of killall immediately after it runs:

killall dd
echo $?

A nonzero result may indicate that no process matched, a permission problem occurred, or another error was reported. A successful signal delivery still does not always mean the program has already exited. Use pgrep -a again, and use killall -w when that option is supported and waiting is appropriate.

Practical workflows

Gracefully stop every process named dd

pgrep -a dd
killall dd
pgrep -a dd

The first command shows the candidates, the second sends the default SIGTERM, and the final command checks for remaining matches.

Force-stop an unresponsive process group by name

pgrep -a dd
killall -s 9 dd
pgrep -a dd

Use this only when the SIGTERM attempt did not work and stopping every matching process is acceptable. The symbolic equivalent is killall -KILL dd.

Confirm each termination

killall -i dd

This is a safer choice when several processes have the same name but should not all be stopped.

Stop a process owned by a particular user

killall -u alice dd

This narrows the selection by owner where the local implementation supports -u. Still inspect the candidates first.

Stop a root-owned process

sudo killall dd

Before using this command, verify that the process is the intended target and that stopping it will not interrupt a critical service.

Troubleshooting

“No process found”

This usually means the program has already exited, the name was misspelled, or the visible command line differs from the process name used for matching. Start with:

pgrep -a dd
ps -ef | grep '[d]d'

Check the exact executable name and then read the local manual page for name-length or matching rules. Some implementations have special behavior when names are longer than the space reserved for a kernel process name.

The process remains running

• The process may be handling SIGTERM or delaying its exit. Wait briefly and check again.
• You may lack permission to signal it. Use sudo only if authorized.
• A service manager or supervisor may have started a replacement process.
• SIGKILL may stop the process, but it does not fix the service or supervisor that owns it.

The process immediately returns

A systemd unit, cron job, container runtime, or another supervisor may automatically restart the program. Identify the responsible manager and stop the managed service through its proper control interface rather than repeatedly running killall. For example, a service should normally be controlled as a service, not by killing one of its worker processes.

Too many processes would be affected

Multiple instances may share a process name, or the selected name may be too broad. List all matches with pgrep -a, use killall -i, filter by user with -u where supported, or select one verified PID with kill.

killall, kill, pkill, and pgrep compared

Use pgrep for discovery, killall for name-based termination, pkill for more flexible pattern selection, and kill when a specific verified PID is the safest target.

Linux and other Unix-like systems

This lesson focuses on Linux. Historically, the name killall has had different behavior on some non-Linux Unix-like systems. Before using it outside Linux, consult the local manual page and confirm what its arguments select.

Exam-relevant points

• A process has both a PID and a process name.
• kill PID selects a process by numeric PID; killall name selects all matching process names.
• killall normally sends SIGTERM, signal 15.
• SIGKILL, signal 9, is forceful and cannot be caught or ignored.
• Always inspect matches before a broad name-based termination.
• Users generally need permission to signal another user's process; sudo may be required.
• A delivered signal does not necessarily mean immediate process exit.
• A supervisor may restart a process after it is killed.

The safest general workflow is: discover with pgrep -a process_name, review ownership and command details, send SIGTERM with killall process_name, verify with pgrep -a process_name, and use SIGKILL only as a justified last resort.

For related command-line fundamentals, see Bourne Again Shell Bash and the Linux topic index.