Silicon Soul

Occasionally, an unresponsive process may hinder the normal operation of your GNU/Linux system. Being able to identify the process IDs (PIDs) of these processes and stop them is an important part of administering a system.

Note: If you are not familiar with the GNU/Linux command line interface, or you intend to use a script obtained from this site, review the Conventions page before proceeding.

ps -C

If you know the exact name of the command associated with a problematic process, you can use the ps -C command to find its associated PID(s).

ps -C ex_command_name

For example, if the command name is firefox-esr, you can find its associated PID like so:

$ ps -C 'firefox-esr'
  PID TTY          TIME CMD
10882 tty2     00:00:38 firefox-esr

Above, you can see that the firefox-esr command is associated with a process that has a PID of 10882.

pgrep

If you are not sure of a problematic process's command name, the pgrep command is an efficient alternative. pgrep, or process grep (Global Regular Expression Print), provides the PID(s) associated with a given target, which can be a variety of things (e.g., a command name, a username, or a terminal).

The target you provide is an extended regular expression that matches against command names and command lines, and makes pgrep more flexible than a simple ps -C command.

pgrep ex_target

For example, you can redo the prior example by using the string fox as the pgrep target:

$ pgrep 'fox'
10882

For more informative output, you can add the -a (--list-full) option:

$ pgrep -a 'fox'
10882 /usr/lib/firefox-esr/firefox-esr

Some of pgrep's useful options are:

-a, --list-full

Display the full command line for the specified command, as well as the PID.

-G ex_group,..., --group ex_group,...

Consider only processes belonging to the given group. ex_group can be a group name or group ID (GID).\

Multiple groups are given as a comma-separated list (ex_group_1,ex_group_2).

-l, --list-name

Display the command name, as well as the PID.

-n, --newest

Select only the newest (most recently started) of the found processes.

-o, --oldest

Select only the oldest (least recently started) of the found processes.

-P ex_ppid,..., --parent ex_ppid,...

Consider only processes whose parent process is ex_ppid.

Multiple parent processes are given as a comma-separated list.

-t ex_terminal,..., --terminal ex_terminal,...

Consider only processes whose controlling terminal is ex_terminal. Terminal names should be given without the leading /dev/ (e.g., tty2).

-u ex_user,..., --euid ex_user,...

Consider only processes with the effective user ID (EUID) ex_user.

Multiple EUIDs are given as a comma-separated list. A username can be specified too.

-U ex_user,..., --uid ex_user,...

Consider only processes with the real user ID (RUID) ex_user.

Multiple RUIDs are given as a comma-separated list. A username can be specified too.

Signals

On a GNU/Linux system, there are numerous signals that act as software interrupts. These signals provide a way for a process (or a user) to communicate with a process, i.e., inter-process communication (IPC).

These are some of the most used signals:

How a process reacts to a signal depends on the signal and the kind of process that receives the signal.

For example, background processes that provide services without a controlling terminal (i.e., daemons) usually re-read their configuration files without a restart when they are sent a SIGHUP signal. On the other hand, most user space processes often die.

The SIGKILL and SIGSTOP signals are handled by the kernel and cannot be ignored or trapped with the trap command. However, the init process (and only the init process) can ignore the SIGKILL signal.

The exit status of a process tells you whether or not the process was terminated by a signal. If it was, the exit status will be 128, plus the number associated with the signal (e.g., 143 is the exit status for a process that was terminated by the SIGTERM signal).

kill

You can terminate a process by providing a PID to the kill command.

kill ex_pid...

Unless you are acting as root, you can only kill your own user's processes.

By default, kill sends a SIGTERM signal. However, you can change this by specifying a different signal on the command line.

kill -ex_signal ex_pid...

Above, -ex_signal can be either the symbolic or numeric signal name (e.g., -SIGKILL or -9). The numbers associated with these signals may differ between GNU/Linux distributions, so you may be better off using the signal name when you need to specify a signal.

You can view all available signals with the kill -l command (the -l option is short for --list).

killall

The killall command kills all processes associated with a given command name.

killall ex_command_name...

As with the kill command, killall sends the SIGTERM signal by default, but you can change that by specifying a different signal on the command line.

Helpful killall options include:

-g, --process-group

Kill the process group to which the process belongs. The kill signal is only sent once per group.

-i, --interactive

Interactively ask for confirmation before killing a process.

-I, --ignore-case

Do case insensitive command name matches.

-l, --list

Output a list of all available signals.

-r, --regexp

Causes killall to interpret the command name as an extended regular expression.

-u ex_user, --user ex_user

Kill only processes that ex_user owns. Command names are optional.

-w, --wait

Wait for all killed processes to die.

killall will check once per second to see if any killed processes still exist and only return if none are left. killall may wait forever if the signal was ignored, had no effect, or if the process stays in a zombie state.

pkill

pkill provides a more flexible way of killing associated processes. Instead of just supporting a command name as an argument (like killall), you can use a variety of other attributes for the command's target (e.g., username, terminal). As with the pgrep command, the target you provide is an extended regular expression that matches against command names and command lines.

pkill ex_target

Like with kill and killall, SIGTERM is used for the default signal, but you can change that by specifying a different signal on the command line.

You can be very specific when using the pkill command. For example, the following sends a SIGKILL signal to commands that match the expression sshd and whose EUID is root:

pkill -SIGKILL -u root sshd

pkill has the same options as the pgrep command.

Documentation

For more on pgrep, kill, killall, and pkill, you can browse their man pages via the command line or online.