In an operating system, there are many programs, which may be either run by an user or by the OS itself (such as system services). Such programs which are running on the system are called “processes”. Usually, a process terminates on its own when they’re done with their task, or when you ask them to quit by pressing a keyboard shortcut or clicking on the “Close” button.
However, sometimes a process can hang up or consume a lot of CPU or RAM. In this situation, you would want to manually “kill” the process. In this article, we will look at various tools you can use to kill processes on a Linux system.
Locating the process to kill
In order to kill a process, you should first locate the details of the process. You can do this through three commands —
pgrep. Depending upon the situation, you can use one of these commands for this purpose.
As we will see later in this article, you can kill a process by its name or its process ID (PID). The PID is a number that uniquely identifies a process. Killing by the process ID is useful when you want to kill only a specific process. On the other hand, killing by the process name is useful when you want to kill all running instances of a particular program.
Locating the process with the top command
We will first look at the
top command. Fire up the top command by typing:
You will get an interactive interface, as shown below. You can browse through this list to find the name or the PID of the process you want to kill.
To browse through this list, you can use the up/down keys. Additionally, the top command also has ways to filter processes by CPU usage, user and process names, which you can read about in this guide.
The leftmost column contains the PID of the process, and the right side contains the program name. As an example, in the above screenshot we have the
vnstatd process running with a process ID of 263.
Locating the process with ps and grep commands
Another way to get a list of process is by running:
In the above command, we have used the flags
aux which have the following meanings:
a: Show processes for all users
u: Display the user who is using the process
x: Show all processes. (Without this,
pswon’t show processes running in a GUI environment.)
The output of the command is similar to that of
top. The PID is available in second column from the left, and the process name is available on the rightmost column.
The advantage of using
ps is that you can easily filter this list with the
grep command. For example, to find a process associated with the term “vnstat”, you can use:
ps aux | grep -i vnstat
Here, we got two results — the
vnstatd process, as well as the
grep process. Since we were searching for all instances of the term “vnstat”, and we were also running
grep with “vnstat” as its argument, we got
grep as well in the results.
Thus, even when there are no “vnstat” related processes running, we would get one entry showing the
So, even though we got a result, there are no processes that are of interest to us.
Finding the PID with pidof and pgrep
grep combination allows us to search for processes. On the other hand, if you know the exact name of a process, you can use
pidof to find its PID.
pidof is pretty straightforward. To get the PIDs of a process with the exact name of “nginx”, use:
If there are processes with the exact name of “nginx”, you will get a list of PIDs, as shown below. If there are none, you will get nothing as the output.
If you don’t know the full name, you can use
pgrep instead of
pidof. As an example, to search for all processes that contain “ngin” somewhere in their name, run:
This will match processes with the exact name of “nginx”, as well as any other process that matches the same criteria. For our system, notice that we get all the PIDs that belonged to “nginx” in the above screenshot.
pkill commands give you far less information. As we shall see in the next section, there are some circumstances in which you can’t kill a process. The output of
ps contain additional information that help you determine if you can really kill a process.
What processes can you kill?
Now that we have located the process, it is time to kill it. However, before we learn how to do so, there are a few things you need to know.
If you are a normal user, you can kill your own processes, but not those that belong to other users. Both
ps show the user under which a process is running. In the case of
top, the second column contains the username. With
ps aux, the first column contains the username.
However, a root user can kill all processes. You can either add
sudo before any command to run it as root, or obtain a root shell by typing
su, and then execute the command.
In Linux, when a process is killed, a “terminating signal” is delivered to the process. Although there are many different types of signals, we mostly deal with the “SIGTERM” and “SIGKILL” signals. They have a numeric value of 15 and 9 respectively. By default, all the process killing commands use “SIGTERM”, which allows the program to run some code before it exits, thus allowing it to terminate “gracefully”. If you want to terminate the process forcibly, you can use “SIGKILL” instead.
The Linux kernel maintains some information related to the state of a process. When a process terminates, the kernel must keep the information around, so that the parent process can find out if the child process was able to complete its tasks and whether it terminated on its own, or it was killed. Until the parent has done so, these “zombie” processes will appear in the list of processes. You can’t kill such a process because it’s just an entry in the list of all processes, and it doesn’t have an actual process associated with it.
When a process performs input/output operations (such as reading from or writing to disks), it is said to be in a state of “uninterruptible sleep”. You can’t kill a process while it is in this state.
You can tell if a process is in the “zombie”(Z) or “uninterruptible sleep”(D) state by looking at the 8th column of the
Killing a process
There are various commands you can use to kill a process —
top. We will begin from the simplest one: the
Killing processes with the killall command
killall command is one of the easiest ways to kill a process. If you know the exact name of a process, and you know that it’s not running as another user and it is not in the Z or D states, then you can use this command directly; there’s no need to manually locate the process as we described above.
By default, For example, to kill a process named “firefox”, run:
To forcibly kill the process with SIGKILL, run:
killall -9 firefox
You can also use
-SIGKILL instead of
If you want to kill processes interactively, you can use
-i like so:
killall -i firefox
If you want to kill a process running as a different user, you can use
sudo killall firefox
You can also kill a process that has been running for a certain period of time with the
-yflags. So, if you want to kill a process that has been running for more than 30 minutes, use:
killall -o 30m <process-name>
If you want to kill a process that has been running for less than 30 minutes, use:
killall -y 30m <process-name>
Similarly, use the following abbreviations for the respective units of time:
Killing processes with the pkill command
Sometimes, you only know part of a program’s name. Just like
pkill allows you to kill processes based on partial matches. For example, if you want to kill all processes containing the name
apache in the name, run:
If you want to use a SIGKILL instead of a SIGTERM, use:
pkill -9 apache
Again, you can also use
-SIGKILL instead of
Killing processes with the kill command
Using the kill command is straightforward. Once you have found out the PID of the process that you want to kill, you can terminate it using the
kill command. For example, if you want to kill a process having a PID of 1234, then use the following command:
As we mentioned previously, the default is to use a SIGTERM. To use a SIGKILL, use
-SIGKILL as we have seen before:
kill -9 1234
Killing processes with the top command
It is very easy to kill processes using the
top command. First, search for the process that you want to kill and note the PID. Then, press
k while top is running (this is case sensitive). It will prompt you to enter the PID of the process that you want to kill.
After you enter the PID, press enter. Now it will ask which signal you want to use to kill the process. If you want to use SIGTERM(15), then simply press enter as it is the default signal. If you want to use SIGKILL(9), then type 9 and press enter.
If you leave the process ID blank and hit enter directly, it will terminate the topmost process in the list. You can scroll using the arrow keys, and change the process you want to kill in this way.
In this post, we saw the various ways to kill processes in Linux. Learning these commands is essential for proper system administration and management. If you want to explore more of those commands, have a look at their respective man pages.