LFCS 55 🐧 Killing Processes — kill, pkill, killall - KandZ

⏱️ Estimated read: 11 min | |

Killing a process is not a single action. It is a request to the kernel to deliver a signal to a process, and the signal’s meaning is determined by the process itself—unless the signal is SIGKILL, which the kernel enforces without the process’s consent. The LFCS exam places process management under the “Operations Deployment” domain and expects you to “diagnose, identify, manage, and troubleshoot processes and services” . The three commands—kill, pkill, and killall—are the tools for sending those signals, and the difference between them is how they identify the target: by PID, by pattern, or by exact name.

The most important distinction is not between the commands but between the signals. SIGTERM (signal 15) is the default for all three commands. It is a polite request: the process can catch it, clean up its resources, and exit gracefully. SIGKILL (signal 9) cannot be caught, blocked, or ignored. The kernel terminates the process immediately, and the process has no opportunity to save data or close connections . The rule is to always try SIGTERM first and escalate to SIGKILL only when the process is unresponsive.

Key point: kill targets a PID, pkill targets a pattern (name or full command line), and killall targets an exact command name. All three send SIGTERM by default. SIGKILL (-9) is the last resort because it bypasses the process’s cleanup handlers and can leave files or database transactions in an inconsistent state.

Why the three commands exist

The PID problem. kill is the primitive. It takes a PID and sends a signal. It is the only one of the three that cannot kill the wrong process due to a name collision, because a PID is unique at any given moment. The GNU Coreutils manual states that kill sends a signal to the processes specified by the pid arguments, and the default signal is TERM . The Bash builtin kill is the same command, but it also accepts job specifications (%1) in addition to PIDs .

The name problem. Remembering PIDs is impractical. pkill (and its sibling pgrep) match processes by name or by other attributes. The Debian manpage states that pkill sends the specified signal to each process that matches the pattern, and the default is SIGTERM . The matching is limited to the first 15 characters of the process name unless the -f option is used to match the full command line . This 15-character limit is a consequence of how the kernel stores the process name in /proc/pid/stat, and it is the source of many “why did my pattern not match” surprises.

The exact-name problem. killall is from the psmisc package, not from procps. It sends a signal to all processes running the specified command, and the default is SIGTERM . The difference from pkill is the matching semantics: killall matches the command name exactly, while pkill uses a regular expression by default. killall also has options that pkill does not, such as -o (older than) and -y (younger than), which allow killing processes based on their age .

The systemd problem. A process managed by systemd should be stopped with systemctl stop, not with kill. The KodeKloud guide explains that systemd will often restart a killed process, because its job is to keep the service running. The systemctl stop command tells systemd to stop the service and not restart it . Killing a systemd-managed process directly is a temporary fix that systemd may undo.

a. `kill`: targeting a PID

kill is the primitive signal sender. It takes one or more PIDs and sends the specified signal to each. If no signal is specified, it sends SIGTERM.

# Send SIGTERM to a process by PID
# SIGTERM is the default, so the -s TERM is optional
kill 1234

# Explicitly send SIGTERM
kill -s TERM 1234

# Send SIGKILL (signal 9)
# Use only when SIGTERM does not work
kill -9 1234

# Send a signal to multiple PIDs in one command
kill 1234 5678 9012

# List all signal names and numbers
kill -l

The PID is the only target kill accepts (in its standard form). The Bash builtin also accepts job specifications (%1 for the first background job), which is useful in an interactive shell but not in a script . The GNU Coreutils version of kill supports a special PID of -1, which sends the signal to all processes the user has permission to signal . This is almost never what you want and should be avoided.

The signal can be specified by name (SIGTERM, TERM, HUP) or by number (15, 9, 1). The -l flag lists the available signals. The kill -l output is the reference for the signal names and numbers that all three commands accept.

b. `pkill`: targeting a pattern

pkill matches processes by a pattern against the process name. The pattern is a regular expression, and the match is against the first 15 characters of the process name unless -f is used.

# Send SIGTERM to all processes named "nginx"
pkill nginx

# Send SIGKILL to all processes named "nginx"
pkill -9 nginx

# Match against the full command line instead of the process name
# This is necessary when the process name is longer than 15 characters
# or when you need to match arguments
pkill -f "python3 /opt/app/server.py"

# Kill only processes owned by a specific user
# -u filters by effective user ID
pkill -u www-data nginx

# Send a different signal
pkill -HUP syslogd

The -u flag is the feature that makes pkill more precise than killall in multi-user environments. The Stuvia LFCS practice exam includes a question about killing a process named backup.sh owned by user backup without affecting other users’ processes. The correct answer is pkill -u backup backup.sh, because killall without user filtering may affect multiple users’ processes . This is a practical distinction that the exam tests.

The 15-character limit is a known pitfall. The Ubuntu manpage states that the process name used for matching is limited to the 15 characters present in /proc/pid/stat, and the -f option is required to match against the full command line . A process named my-long-application-name is stored as my-long-applica (15 characters), and pkill my-long-application-name will not match it unless -f is used.

c. `killall`: targeting an exact command name

killall sends a signal to all processes running the specified command. It is from the psmisc package, and its matching is different from pkill: it matches the command name exactly, and it has options for age-based filtering.

# Send SIGTERM to all processes named "firefox"
killall firefox

# Send SIGKILL
killall -9 firefox

# Require an exact match for names longer than 15 characters
# Without -e, killall may kill processes that match only the first 15 characters
killall -e my-long-application-name

# Kill only processes older than a given time
killall -o 1h firefox

# Kill only processes younger than a given time
killall -y 30m firefox

# Interactive: ask for confirmation before killing each process
killall -i firefox

# Wait for the processes to die after sending the signal
killall -w firefox

The -e flag is the answer to the 15-character problem. The Debian manpage states that if a command name is longer than 15 characters, the full name may be unavailable, and killall will kill everything that matches within the first 15 characters. With -e, such entries are skipped . This is the opposite of pkill‘s -f flag: killall excludes the ambiguous matches, while pkill -f includes the full command line in the match.

The -o and -y flags are unique to killall. They allow killing processes based on their age, which is useful for cleaning up stale worker processes or old sessions. The time units are s, m, h, d, w, M, and y for seconds, minutes, hours, days, weeks, months, and years .

Complete Example Session

The following session finds a runaway process, kills it with SIGTERM, verifies it is gone, and escalates to SIGKILL when it does not respond.

# ============================================
# PART 1: FIND THE PROCESS
# ============================================
# Find the PID of the nginx processes
pgrep nginx

# Output example:
# 1234
# 1235
# 1236

# ============================================
# PART 2: SEND SIGTERM
# ============================================
# Send SIGTERM to all nginx processes
# The default signal is SIGTERM, so no flag is needed
pkill nginx

# ============================================
# PART 3: VERIFY THE PROCESS IS GONE
# ============================================
# Check if any nginx processes remain
pgrep nginx

# If the output is empty, the processes exited gracefully
# If the output still shows PIDs, the processes ignored SIGTERM

# ============================================
# PART 4: ESCALATE TO SIGKILL
# ============================================
# Send SIGKILL to the remaining processes
# -9 is SIGKILL; the process cannot ignore it
pkill -9 nginx

# Verify again
pgrep nginx
# The output should now be empty

# ============================================
# PART 5: KILL BY PID (THE PRECISE METHOD)
# ============================================
# Start a process and get its PID
sleep 300 &
PID=$!

# Kill it by PID with SIGTERM
kill $PID

# Verify it is gone
ps -p $PID
# The output should show no process

# ============================================
# PART 6: KILL BY NAME WITH USER FILTER
# ============================================
# Kill only the processes named "backup.sh" owned by user "backup"
pkill -u backup backup.sh

The six parts cover finding the process with pgrep, sending SIGTERM with pkill, verifying the result, escalating to SIGKILL, killing by PID with kill, and filtering by user with pkill. What the session demonstrates is that the signal is the request, and the process’s response determines whether escalation is necessary.

Quick Reference

Command Comparison

Command	Target	Matching	Package
`kill`	PID	Exact PID	`coreutils` / bash builtin
`pkill`	Pattern	Regex, 15-char name or `-f` full line	`procps`
`killall`	Name	Exact name, `-e` for long names	`psmisc`

Signals

Signal	Number	Catchable	Meaning
`SIGTERM`	15	Yes	Graceful termination
`SIGKILL`	9	No	Immediate termination
`SIGINT`	2	Yes	Interrupt (Ctrl+C)
`SIGHUP`	1	Yes	Hangup / reload

Common Options

Option	Command	Effect
`-9`	All	Send SIGKILL
`-f`	`pkill`	Match full command line
`-u user`	`pkill`	Filter by user
`-e`	`killall`	Exact match for long names
`-o 1h`	`killall`	Older than 1 hour
`-w`	`killall`	Wait for processes to die

Best Practices

✅ Do This:

# Try SIGTERM first
kill 1234

# Use pkill for pattern matching
pkill -f "python3 /opt/app/server.py"

# Filter by user when multiple users run the same command
pkill -u www-data nginx

# Verify the process is gone
pgrep nginx

❌ Don’t Do This:

# Use SIGKILL as the first attempt
kill -9 1234 # may corrupt data

# Kill a systemd-managed process directly
kill 1234 # systemd may restart it; use systemctl stop

# Use kill -1 to kill all processes
kill -1 # affects every process the user can signal

Common Pitfalls

Pitfall	Why It Happens	Fix
`pkill` does not match	Name longer than 15 characters	Use `pkill -f`
Process restarts after kill	Managed by systemd	Use `systemctl stop`
`killall` kills too much	No `-e` on long names	Use `killall -e`
Process ignores SIGTERM	Stuck in uninterruptible sleep	Use `kill -9`
Zombie process remains	Parent has not reaped it	Kill the parent

Real-World Examples

1. Kill by PID

kill 1234

2. Force kill by PID

kill -9 1234

3. Kill by name

pkill nginx

4. Kill by full command line

pkill -f "python3 /opt/app.py"

5. Kill by name and user

pkill -u www-data nginx

6. Kill all with exact name

killall -e my-long-app

7. Kill older processes

killall -o 1h firefox

8. Interactive kill

killall -i firefox

9. Reload a daemon

pkill -HUP syslogd

10. List signals

kill -l

Visual

Signal Escalation

┌──────────────────────────────────────────────┐
│  SIGTERM (15)                                │
│  process catches it                          │
│  saves data, closes connections, exits       │
│         │                                    │
│    ┌────┴────┐                               │
│    │         │                               │
│  exits     ignores                           │
│    │         │                               │
│    ▼         ▼                               │
│  done     SIGKILL (9)                        │
│           kernel terminates immediately      │
│           no cleanup                         │
└──────────────────────────────────────────────┘

Command Target

┌──────────────────────────────────────────────┐
│  kill 1234                                   │
│  → exact PID                                 │
│                                              │
│  pkill nginx                                 │
│  → pattern match on process name             │
│  → -f for full command line                  │
│                                              │
│  killall nginx                               │
│  → exact command name                        │
│  → -e for long names                         │
└──────────────────────────────────────────────┘

systemd Interaction

┌──────────────────────────────────────────────┐
│  kill 1234                                   │
│  → systemd sees the process died             │
│  → systemd restarts it (if configured)       │
│                                              │
│  systemctl stop nginx.service                │
│  → systemd stops the service                 │
│  → systemd does not restart it               │
└──────────────────────────────────────────────┘

Summary

Item	Value
`kill`	Target by PID
`pkill`	Target by pattern
`killall`	Target by exact name
Default signal	`SIGTERM` (15)
Force signal	`SIGKILL` (9)
`pkill -f`	Match full command line
`pkill -u`	Filter by user
`killall -e`	Exact match for long names
systemd-managed	Use `systemctl stop`

Key takeaways:

The signal is the request, not the command. kill, pkill, and killall all send signals. The default is SIGTERM, which the process can handle and ignore. SIGKILL is the kernel-enforced termination that the process cannot ignore .
kill is the primitive. It targets a PID and cannot kill the wrong process due to a name collision. It is the safest tool when you know the PID.
pkill matches patterns. It is the tool for killing by name, and the -f flag extends the match to the full command line. The 15-character limit on the process name is the reason -f is often necessary .
killall matches exact names. It has the -e flag to skip ambiguous matches, and the -o and -y flags to filter by process age .
pkill -u is the precise multi-user tool. When multiple users run the same command, pkill -u user pattern kills only that user’s processes .
systemd-managed processes need systemctl stop. Killing them directly may trigger a restart. The systemctl stop command tells systemd to stop the service and not restart it .

Remember: Killing a process is not about the command you type. It is about the signal you send and the process’s response to it. SIGTERM is a request; SIGKILL is a command. The three tools differ only in how they find the target: kill by PID, pkill by pattern, killall by exact name. The LFCS exam expects you to know all three, and it expects you to know that systemctl stop is the correct tool for a systemd-managed service. The order is always the same: try SIGTERM first, verify the process is gone, and escalate to SIGKILL only when the polite request fails.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!