Processes · Lesson 7

kill (Terminate)

Learn how to identify a process and send an appropriate signal with `kill` using a safe escalation sequence.

The kill command sends a signal to a process or process group. Its name is historical: the requested signal might terminate, stop, continue, or prompt some application-defined action. Always confirm the exact target and understand the program's documented signal behavior before sending one.

Requesting an Orderly Termination

With only a PID, kill sends SIGTERM by default:

$ kill 12445

Prefer the symbolic name when specifying a signal explicitly:

$ kill -TERM 12445

SIGTERM has a default action of termination, but a program can catch or ignore it. A well-designed service can use a handler to stop accepting work, save appropriate state, and release application resources. That is a possibility, not a guarantee of immediate or successful cleanup.

Which signal does kill PID request by default?

Verifying the Target

PIDs can be reused, so a stale PID can identify a different process later. Inspect the live target immediately before acting:

$ ps -p 12445 -o pid,ppid,user,lstart,stat,cmd

Check its user, start time, command, parent, service ownership, and operational role. If a service manager owns the process, use that manager's stop or reload command when possible so it can maintain correct state and avoid immediately restarting the child.

You may signal processes you own, subject to credential rules. Signaling another user's process normally requires appropriate privilege. Do not use a broad name-based command until you have reviewed every match.

Why should you inspect a PID immediately before signaling it?

Checking Signal Permission with Signal Zero

Signal number zero performs error checking without delivering a real signal:

$ kill -0 12445

A successful result means a process with that PID exists and the caller is permitted to signal it at that instant. Failure is ambiguous: the process might not exist, or the caller might lack permission. Examine the error and exit status rather than translating every failure into “not running.” It is also only a momentary check and cannot eliminate a later PID-reuse race.

What does successful kill -0 PID establish at that moment?

Escalating Only When Necessary

If an authorized target does not terminate after SIGTERM, allow a workload-appropriate timeout and investigate why. Then, when forced termination is justified, send:

$ kill -KILL 12445

SIGKILL cannot be caught, ignored, or blocked, so the program cannot perform application-level cleanup. It can leave incomplete transactions, temporary state, or recovery work for other components. Use it as an escalation, not a routine first step.

Other signals are meaningful only according to the receiving program's contract. SIGHUP often requests configuration reload, but some programs retain its default termination behavior. SIGSTOP pauses without cleanup and SIGCONT resumes a stopped process.

What is the main operational drawback of SIGKILL?

Practice signal selection only on processes you started in an isolated environment. The Manage and Monitor Linux Processes lab provides a controlled workflow for inspection and termination.

Lesson complete

You finished kill (Terminate)

You can now send process signals with a deliberate, verifiable workflow.

Confirm the live target and its supervisor before acting.
Use SIGTERM as the normal termination request.
Interpret signal zero as a momentary existence-and-permission check.
Reserve SIGKILL for justified escalation after investigation.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Next Lesson

Back to Processes