Stopping Processes: kill and Signals

Signals

You stop a process by sending it a signal, a small message from the kernel. Despite its name, kill is the command that sends signals. By default it sends TERM, which politely asks the program to finish.

This machine has a report-builder that got stuck. Find its PIDs, then stop them. $( ) puts the PIDs from pgrep into the command, so you don't have to type them:

pgrep -a report-builder
kill $(pgrep report-builder)
pgrep -a report-builder

In the terminal

student@vulntech:~$ pgrep -a report-builder
1604 /bin/bash /usr/local/bin/report-builder
1611 /bin/bash /usr/local/bin/report-builder
student@vulntech:~$ kill $(pgrep report-builder)
student@vulntech:~$ pgrep -a report-builder

The last pgrep printed nothing: they're gone. pkill does both steps in one, and killall is similar but matches the exact program name:

pkill report-builder
pgrep -c report-builder

In the terminal

student@vulntech:~$ pkill report-builder
student@vulntech:~$ pgrep -c report-builder
0

The signals you'll use

Choose a signal by name or number: kill -HUP 1234, kill -9 1234. kill -l lists them all.

When TERM isn't enough

A program can ignore TERM, and a badly stuck one may never get round to finishing. stubborn ignores polite signals, so it survives pkill. Then, and only then, use KILL:

pkill stubborn
pgrep -a stubborn
pkill -KILL stubborn
pgrep -a stubborn

In the terminal

student@vulntech:~$ pkill stubborn
student@vulntech:~$ pgrep -a stubborn
1618 /bin/bash /usr/local/bin/stubborn
student@vulntech:~$ pkill -KILL stubborn
student@vulntech:~$ pgrep -a stubborn

Common mistake: Don't reach for kill -9 first. KILL gives the program no chance to save its work, delete its temporary files or tell anyone it's leaving. Try TERM, wait a few seconds, and only then use -9.

Other users' processes

You may only signal your own processes. The web server belongs to www, so stopping it takes sudo:

pkill webserver
sudo pkill webserver
pgrep -c webserver

In the terminal

student@vulntech:~$ pkill webserver
pkill: killing pid 1625 failed: Operation not permitted
student@vulntech:~$ sudo pkill webserver
[sudo] password for student:
student@vulntech:~$ pgrep -c webserver
0

Remember: kill PID, pkill name and killall name send TERM. -9 (KILL) is the last resort. Other users' processes need sudo.