Kill Process in Linux: kill, killall, and pkill Explained

Kill Process in Linux: kill, killall, and pkill ExplainedProcesses are the running programs that make a Linux system work. Sometimes a process misbehaves — it hangs, uses excessive CPU or memory, or refuses to respond. Knowing how to stop a process safely and effectively is a fundamental skill for any Linux user or administrator. This article explains three commonly used tools for terminating processes: kill, killall, and pkill. You’ll learn how each works, when to use which, common signal options, examples, and some troubleshooting tips.

---

Overview: kill vs killall vs pkill

• kill — targets processes by PID (process ID). It’s precise and safe when you know the PID.
• killall — targets processes by name. It may kill multiple processes with the same name.
• pkill — similar to killall but uses pattern matching and supports more flexible selection (user, group, terminal, full command line, etc.).

Each tool sends signals to processes. The default signal is SIGTERM (15), which requests graceful shutdown. If a process ignores SIGTERM, a stronger signal such as SIGKILL (9) forces immediate termination.

---

Signals you should know

Common signals and their typical use:

• SIGTERM (15) — polite request to terminate; allows cleanup.
• SIGINT (2) — interrupt (like Ctrl+C in a terminal).
• SIGHUP (1) — hangup; often used to reload configuration.
• SIGKILL (9) — forceful immediate termination; cannot be caught or ignored.
• SIGSTOP (19 on many systems) — stop (pause) a process; can later be continued with SIGCONT.

Syntax for specifying signals:

• By name: kill -SIGTERM or kill -TERM
• By number: kill -15 Most utilities accept both numeric and named forms.

---

kill — by PID (precise control)

kill sends a signal to a specific PID (or list of PIDs). Use it when you know the exact process ID.

Basic usage:

kill <pid> 

This sends SIGTERM. To force:

kill -9 <pid> 

To send by name:

kill -s SIGINT <pid> 

How to find the PID:

• ps aux | grep program
• pgrep -f pattern
• pidof program
• top, htop, or system monitoring tools

Examples:

• Graceful stop:

  
  kill 12345 

• Force kill:

  
  kill -9 12345 

• Multiple PIDs:

  
  kill 12345 23456 34567 

When to use kill:

• You need to target a single known process (e.g., a specific worker).
• You want maximum control and minimal risk of killing unrelated processes.

Caveats:

• PIDs can be reused: be careful if there’s a delay between discovering a PID and killing it.
• Some processes ignore SIGTERM; resorting to SIGKILL prevents cleanup and may cause data loss.

---

killall — by process name (simple name-based termination)

killall sends a signal to all processes matching a given name. It’s straightforward but potentially broad.

Basic usage:

killall processname 

This sends SIGTERM to all processes named processname. To force:

killall -9 processname 

Options you may use:

• -v — verbose (show what was killed)
• -I — case-insensitive matching
• -r — interpret name as regular expression (on some systems)
• -u user — kill only processes owned by a specific user

Examples:

• Kill all instances of Firefox:

  
  killall firefox 

• Force kill case-insensitively:

  
  killall -9 -I MyApp 

When to use killall:

• You want to stop every instance of a named program (e.g., all copies of a crashed GUI app).
• You’re scripting shutdown of multiple identical workers.

Caveats:

• On some systems (notably older UNIX variants), killall behaves differently (e.g., it can kill all processes on the system). On Linux distributions, killall from psmisc kills by name; still, be careful and ensure the expected behavior on your system.
• Name collisions: different programs can share the same name.

---

pkill — pattern-based and attribute filtering

pkill is part of the procps (or procps-ng) toolkit. It matches processes by name or pattern and supports many filters (user, group, session, terminal, full command line), making it more flexible than killall.

Basic usage:

pkill pattern 

This sends SIGTERM to processes whose name matches pattern. To force:

pkill -9 pattern 

Useful options:

• -f — match against full command line, not just the process name
• -u user — only processes of the specified user
• -U uid — match real UID
• -g pgrp — match process group
• -t tty — match controlling terminal
• -n / -o — newest or oldest matching process only
• -x — match exact process name
• -c — count matching processes (don’t kill)

Examples:

• Kill processes whose command line contains “python script.py”:

  
  pkill -f "python script.py" 

• Kill all processes owned by user alice:

  
  pkill -u alice 

• Kill the newest matching process named worker:

  
  pkill -n worker 

When to use pkill:

• You need flexible matching (partial name, command-line, or user filters).
• You want to avoid killing unrelated programs with identical base names by matching the full command line.

Caveats:

• Pattern mistakes can match more than intended; test with -c or use pgrep first to see matches:

  
  pgrep -a -f pattern 

---

Finding and confirming targets safely

Before sending destructive signals, identify targets and confirm:

• pgrep — list matching PIDs:

  
  pgrep -l firefox pgrep -a -f "python script.py" 

• ps with filtering:

  
  ps aux | grep [p]rocessname 

• top/htop — interactive view to identify high-CPU or hung processes.

Tip: use SIGTERM first. Only use SIGKILL when a process fails to terminate after a reasonable wait.

---

Practical examples and workflows

1. Graceful shutdown of a single service:

   pid=$(pgrep -f "myservice --config /etc/myservice.conf") kill $pid 

2. Restarting all worker processes for a user:

   pkill -u deployer -TERM worker sleep 2 pkill -u deployer -9 worker   # force any that didn’t stop 

3. In a script, check what would be killed:

   pgrep -a -f "long_running_task"    # review pkill -f "long_running_task"       # kill 

4. Using systemd instead of direct kills: For system services, prefer systemctl:

   sudo systemctl restart nginx 

   systemd orchestrates proper shutdown/startup and handles dependencies.

---

Troubleshooting: when a process won’t die

• Zombie processes: A process in Z state is already dead but waiting for its parent to reap it. You cannot kill a zombie; kill or restart its parent, or reboot if necessary.
• Uninterruptible sleep (D state): Typically waiting on I/O or kernel resources (e.g., NFS). SIGKILL won’t remove it until the I/O completes or the underlying issue is fixed.
• Permission denied: You may need root privileges to kill processes owned by other users:

  
  sudo kill <pid> sudo pkill -u anotheruser processname 

• Process respawning: If a supervisor (systemd, monit, upstart) restarts the process immediately, stop it via the supervisor (systemctl stop service) rather than killing manually.

---

Safety checklist before killing

• Confirm PID(s) with pgrep/ps/top.
• Prefer SIGTERM; wait a few seconds.
• Use SIGKILL only when necessary.
• For services, prefer systemctl or the service manager.
• When scripting, log actions and consider dry-run (pgrep -a) first.

---

Summary

• Use kill when you know the PID and want precise control.
• Use killall for simple name-based termination of all matching processes.
• Use pkill for pattern-based or attribute-filtered termination (more flexible and powerful).
• Prefer gentle signals (SIGTERM) first; use SIGKILL only as a last resort.
• Confirm targets with pgrep/ps/top and prefer service managers for supervised processes.

This knowledge will help you handle misbehaving processes safely and reduce risks such as data loss or inadvertently stopping unrelated services.