How to Kill a Process in Linux

There are numerous methods that can be utilized to kill a process in Linux. This tutorial will teach you how to find and kill broken processes.

A process can become orphaned easily. Whether on purpose or not, a parent process can crash and leave a child process running. Sometimes, a parent process fails to reap a completed child process, and it becomes a zombie.

Both of these processes are stuck and need manual intervention. Enter job control. Let’s take a look at how to kill broken processes.

Let’s look at a few commands:

• top (and why htop is probably better)
• ps
• kill

Top (Search and Destroy)

Before you can begin sending kill messages to all the processes, you need to know what you have. We don’t assume we have broken processes running, and know exactly what to look for. That’s what we have top for. Let’s run vim and pop it in the background.

Okay, now we have a process we can’t interact with normally. Let’s run top. The normal output isn’t helpful, so we’ll run a filter.

• Press shift+l
• Type vim
• Press enter

There’s our output. You’ll notice on the first line, it tells us uptime, number of users, and our load averages. You’ll also notice there’s important information in the columns. Normal day-to-day I’m looking at S, %CPU, and TIME+. If a process is in state Z (zombie) I know to kill it. If a process is over 100% CPU, it’s overrun and also may need to be killed. Or if a process has been going on for a few days, maybe it’s time to restart it. Though that’s possibly paranoia, and not necessary in the majority of cases.

Today we’re looking at the second line, hunting for zombies and searching for orphans. For our example we don’t have a zombie process running, so we’ll filter for the “2 stopped” processes.

• Press o
• Type: S=T

Now that we filtered down to only processes in the S=T (state=stopped) filter, we can kill them. While in top, you can press k, enter the process PID, and press enter. If you’re running through, you’ll notice it might take a while to end. Instead, press k again, enter the PID, and change the signal to 9.

It’s not perfect, but if you have a top window running as a status window, you’re already there. You can also send the kill signal instead of the stop signal.

htop

Okay, I’ll admit. It’s not much different to top. Except for the color.

So much color.

PS

PS, process status. Our lovely native utility for viewing process information on our system. This tool reads from the files in /proc. Most days, you’re going to be using:

• -a, show processes for all users
• -u, display process owners
• -x, show process not attached to a terminal

Running ps -aux alone will net you everything and anything, but this is rarely helpful. Let’s pipe to grep, and find our lost vim.

And there it is! You’ll also see your current grep command in there. If you don’t want that, change up your grep a smidge.

There. Now look for vim, but don’t show us the grep process looking for vim. Now let’s kill the process. We’ll start with killall, and then try kill.

Killing a Process (Killall & Kill)

Okay, we have what we need. A process name (vim) and the process ID (140464). killall uses names, and kill uses process ID. Each sends the same set of signals: HUP, INT, KILL, TERM, and STOP are the most common. If you want to learn more, check the list with kill -l.

Let’s dig into the common signals:

• HUP, Signal Value 1. Hangup. A dated term that’s survived since phone and modem lines. Hangup in most systems will cause a daemon to restart, instead of end.
• INT, Signal Value 2. Interrupt. Normally, when interacting with a process you can send CTRL+C to interrupt. Sending kill -2 runs the same interrupt signal.
• KILL, Signal Value 9. Kill. This is what we’re looking for usually. This kills a PID immediately.
• TERM, Signal Value 15. Terminate. This is normal behavior for a process ending. If you want to be kind to a process, this is how you want to end it, gracefully. By default, kill sends signal 15.
• STOP, Signal Values 17, 19, 23. This pauses a process. Say you’re copying a large directory, and realize you want to remove some folders. Send SIGSTOP, remove the folders, and resume with SIGCONT.

Okay, I added signal values. Those are the numeric value of a signal and can be used in your kill command instead of typing SIGHUP. For instance:

• killall -9 vim

Will try to kill everything named vim. I recommend that whenever you are using killall, you verify that your process has been successfully killed afterward.

If there’s anything left, kill manually with kill -9 followed by the process id. e.g.:

• kill -9 140464

Conclusion

There it is, a simple explanation of killing a process. Start with top for overrun processes. Use killall with stuck graphical processes. Isolate any remnants with kill. That’ll take care of the majority of your problems.

When in doubt, reboot. Follow proper notification procedures before you do. Learn more shell commands, and brush up on your Linux skills.