How to Kill a Linux Process Using the “kill” Command

A process in Linux is an instance of a running program. Each process has a unique identifier called a process ID (PID) that is used by the operating system to manage it. Processes can be created by executing commands or by other processes (called parent processes) that fork new processes (called child processes).

To kill a process in Linux means to terminate it forcefully by sending it a signal. A signal is a message that tells a process to perform some action. There are different types of signals, such as SIGTERM (terminate), SIGKILL (kill), SIGINT (interrupt), etc. The kill command is used to send signals to processes by specifying their PIDs or names.

Understanding Processes and Their Various States

One way to categorize processes is by their relationship to the parent process that created them. A process that is created by another process is called a child process, and the process that created it is called a parent process. A child process inherits some attributes from its parent, such as user ID, group ID, environment variables, and file descriptors. A child process can also communicate with its parent through signals or pipes.

Another way to categorize processes is by their state or status. A process can be in one of the following states:

• Running: The process is either executing on the CPU or ready to execute on the CPU.
• Sleeping: The process is waiting for an event to occur, such as input/output, a signal, or a timer.
• Stopped: The process is suspended by a signal, such as SIGSTOP or SIGTSTP.
• Zombie: The process has terminated but its parent has not yet reaped its exit status.
• Orphan: The process has no parent because its parent has terminated.

A third way to categorize processes is by their daemonization. A daemon is a process that runs in the background and performs some service for the system or other processes. A daemon usually detaches itself from its parent and from the controlling terminal, and runs with minimal user interaction. Examples of daemons are cron, sshd, syslogd, and httpd which are all system processes.

Viewing All Processes and Their Process ID

The following command will display all running processes and their process ID:

ps aux

Alternatively, you can search for all the process IDs by searching for the name using the command pgrep [process name]. In the example below I’ve searched for all processes that contain SSH.

Most Common Kill Signals

When using the kill command in the next section, you can change the default signal (15) to any of the ones below, depending on your need. For example, if we needed to kill a process right away, we can use kill -9 [process ID #].

Killing a Process

The below command will kill a process. All you will need to do is to fill in the relevant PID.

Consider a scenario where we have crond service running with process ID 105705, such as below.

With the command kill -9 105075 we can kill this process. Once that command runs, you can check once more and will find that no such service/process exists.

*NOTE: kill -9 will use the kill signal 9 which will kill the process immediately without letting the process finish its child processes peacefully. Consider first using kill [PID] by itself before adding the -9 value.

To kill all instances of a process, you can use the pkill [process name] command, while filling in the relevant process name.

For example, using pgrep tmux we can find all process IDs that match tmux. Then, to kill all processes that match tmux, I can use pkill tmux. An example is shown below.

*NOTE: It is always good practice when killing processes to make sure that you’re killing the right process, so be sure to take your time when executing the commands above.