kill (command)

In Unix and Unix-like operating systems, kill is a command used to send a signal to a process. By default, the message sent is the termination signal, which requests that the process exit. But kill is something of a misnomer; the signal sent may have nothing to do with process killing. The kill command is a wrapper around the kill() system call, which sends signals to processes or process groups on the system, referenced by their numeric process IDs (PIDs) or process group IDs (PGIDs). kill is always provided as a standalone utility as defined by the POSIX standard. However, most shells have built-in kill commands that may slightly differ from it.[1][2]

There are many different signals that can be sent (see signal for a full list), although the signals in which users are generally most interested are SIGTERM ("terminate") and SIGKILL ("kill"). The default signal sent is SIGTERM. Programs that handle this signal can do useful cleanup operations (such as saving configuration information to a file) before quitting. However, many programs do not implement a special handler for this signal, and so a default signal handler is called instead. Other times, even a process that has a special handler has gone awry in a way that prevents it from properly handling the signal.

All signals except for SIGKILL and SIGSTOP ("stop") can be "intercepted" by the process, meaning that a special function can be called when the program receives those signals. The two exceptions SIGKILL and SIGSTOP are only seen by the host system's kernel, providing reliable ways of controlling the execution of processes. SIGKILL kills the process, and SIGSTOP pauses it until a SIGCONT ("continue") is received.[3]

Unix provides security mechanisms to prevent unauthorized users from killing other processes. Essentially, for a process to send a signal to another, the owner of the signaling process must be the same as the owner of the receiving process or be the superuser.

The available signals all have different names, and are mapped to certain numbers. It is important to note that the specific mapping between numbers and signals can vary between Unix implementations. SIGTERM is often numbered 15 while SIGKILL is often numbered 9.

A process can be sent a SIGTERM signal in four ways (the process ID is '1234' in this case):

kill 1234
kill -s TERM 1234
kill -TERM 1234
kill -15 1234

The process can be sent a SIGKILL signal in three ways:

kill -s KILL 1234
kill -KILL 1234
kill -9 1234

Other useful signals include HUP, TRAP, INT, SEGV and ALRM. HUP sends the SIGHUP signal. Some daemons, including Apache and Sendmail, re-read configuration files upon receiving SIGHUP, so the kill command may be used for this too. A SIGINT signal can be generated very simply by pressing CTRL+C in most Unix shells. It is also common for CTRL+Z to be mapped to SIGTSTP ("terminal stop"), and for CTRL+\ (backslash) to be mapped to SIGQUIT, which can force a program to do a core dump.

• killall - on some variations of Unix, such as Solaris, this utility is automatically invoked when the system is going through a shutdown. It behaves much like the kill command above, but instead of sending a signal to an individual process, the signal is sent to all processes on the system. However, on others such as IRIX, Linux, and FreeBSD, an argument is supplied specifying the name of the process (or processes) to kill. For instance, to kill a process such as an instance of the XMMS music player invoked by xmms, the user would run the command killall xmms. This would kill all processes named xmms, and is equivalent to kill `pidof xmms` on systems like Solaris.
• pkill - signals processes based on name and other attributes. It was introduced in Solaris 7 and has since been reimplemented for Linux, NetBSD and OpenBSD. pkill makes killing processes based on their name much more convenient: e.g. to kill a process named firefox without pkill (and without pgrep), one would have to type kill `ps --no-headers -C firefox -o pid` whereas with pkill, one can simply type pkill firefox.
• xkill - if called without any parameters, the mouse cursor changes from an arrow to an "x" icon, and the user can click on a window to force the X server to close the connection with the client owning the window. This often causes the process to terminate when it detects that its connection to the X server has been closed.

The kill command is also available as a shell builtin in the OS-9 shell. It is used to kill another process by process ID.[4]

Stop the process with the process ID "7":

$ kill 7

The taskkill command on Microsoft Windows

In Microsoft's command-line interpreter Windows PowerShell, kill is a predefined command alias for the Stop-Process cmdlet.

Microsoft Windows XP, Vista and 7 include the command taskkill[5] to terminate processes. The usual syntax for this command is taskkill /im "IMAGENAME". An "unsupported" version of kill was included in several releases of the Microsoft Windows Resource Kits available for Windows 98.[6]

GNU versions of kill have been ported via Cygwin and run inside of the Unix environment subsystem that Microsoft Windows Services for UNIX provides (Microsoft acquired Windows Services for Unix wholesale via their purchase of Softway Systems and their Interix product on September 17, 1999).[7]

The taskkill command on ReactOS

The ReactOS implementation is based on the Windows variant. It was developed by Andrew Riedi, Andrew Nguyen, and He Yang. It is licensed under the LGPLv2.1 or later.[8]

Find all processes beginning with the letter "p" that were developed by Microsoft and use more than 10 MB of memory and kill them:

PS C:\> ps p* | where { $_.Company -like "Microsoft*" -and $_.WorkingSet -gt 10MB } | kill -confirm

Confirm
Are you sure you want to perform this action?
Performing operation "Stop-Process" on Target "powershell (6832)".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): A
PS C:\>

Here is a simpler example, which asks the process Explorer.exe to terminate:

PS C:\> taskkill /im explorer.exe

This example forces the process to terminate:

PS C:\> taskkill /f /im explorer.exe

Processes can also be killed by their PID number:

PS C:\> taskkill /pid 3476

Singularity shell, the standard shell for Microsoft Research's microkernel operating system Singularity includes a kill command to terminate background processes.

Stop the process with the name "SampleProcess":

Singularity>kill SampleProcess

Stop the process with the process identifier "42":

Singularity>kill 42

Under Plan 9 from Bell Labs, the kill program does not actually perform this termination, nor does it take process IDs. Rather, it takes the actual names of processes and outputs the commands for rc, the shell used by Plan 9, to kill the process.[9]

A similar command provided is called slay, which does the same but for processes that refuse to be killed this way.[9]

For example, to kill all instances of troff, one types:

kill troff | rc

The kill command has also been ported to the IBM i operating system.[10]