CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Process Management / kill

kill

Send a signal to a process

Beginneressentialsignalsprocesses

kill sends a signal to a process by PID. Despite the name, the default signal, SIGTERM, is a polite request to shut down; SIGKILL (-9) is the forced, uncatchable version, and SIGHUP is how many daemons are told to reload their config.

Syntaxkill [-s SIGNAL | -SIGNAL] PID|%JOB... kill -l [NUMBER]

Watch it run

You need to stop the Node app that was started by hand, and let it finish its in-flight requests.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 4
pgrep -a node

First get the PID. pgrep -a prints the PID and the full command line, so you can be sure it is the right process.

Anatomy of a command

$
commandkill

Usually the bash builtin (so it also understands %job), otherwise /usr/bin/kill from util-linux.

How it works

kill is a thin wrapper around the kill(pid, sig) system call. The kernel first checks permission: your real or effective UID must match the target's, or you need CAP_KILL (root). It then marks the signal pending on the target and wakes it if it is sleeping interruptibly. When the target next returns to user mode, the kernel runs its handler if it installed one with sigaction, or the default action: terminate (TERM, INT, HUP), terminate with a core dump (QUIT, SEGV, ABRT), stop (STOP, TSTP) or ignore (CHLD, WINCH). SIGKILL and SIGSTOP can't be caught or ignored: the kernel acts directly. A process in D state (uninterruptible I/O) only dies when the I/O returns. When a process dies of a signal, its parent sees exit status 128 + signal number: 143 for TERM, 137 for KILL.

kill asks the kernel to mark a signal pending; the target's handler or the default action decides what happens next.

typekill(2051,15)set pendingcaughtnot caughtSIGCHLDYoukill 2051bashkill builtinKernelpermission checknode 2051runningTERM handlerdrain, exit 0Default actionterminateParentwait() status
1/8
You run kill 2051

kill is a bash builtin. With no signal given it sends SIGTERM, number 15.

← → to step

Options you'll actually use

(none)Send SIGTERM (15): ask the process to exit cleanly
-9 / -KILLSIGKILL: kernel ends the process now; no cleanup, no handler
-1 / -HUPSIGHUP: terminal hung up; many daemons reload config on it
-2 / -INTSIGINT: what Ctrl-C sends
-3 / -QUITSIGQUIT: exit with a core dump (Java prints a thread dump)
-STOP / -CONTPause a process (uncatchable) / resume it
-USR1 / -USR2App-defined: reopen logs (nginx USR1), dump state ...
-0Send nothing; only check that the PID exists and you may signal it
-l [N]List signal names, or translate a number (kill -l 137 = KILL)
-- -PGIDSignal every process in a process group

Common mistakes

Reaching for kill -9 first

SIGKILL skips every cleanup: open transactions, temp files, PID files and locks are left behind, and buffered data is lost.

kill PID, wait 5-10 s, and only then kill -9 PID
kill -9 on a process stuck in D state, then again and again

A task in uninterruptible sleep can't act on any signal until its I/O completes. The kill is queued, not ignored.

Find the stuck mount or device (cat /proc/PID/stack, dmesg) and fix that
kill $(pidof myapp) in a script without checking

If nothing matches, kill gets no arguments and prints a usage error; if a PID was reused, you hit the wrong process.

pkill -x myapp, or systemctl stop myapp for services
kill -HUP on any daemon to 'reload' it

HUP's default action is terminate. Only programs that install a HUP handler (nginx, sshd, rsyslog) reload; others just die.

Check the docs, or use systemctl reload SERVICE which knows the right method

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Start `sleep 600 &`, then stop it with the default signal and confirm it's gone.

  2. 2

    Find out which signal number SIGUSR1 has, and which signal exit code 143 means.

  3. 3

    Pause a running `sleep 600 &` with a signal, check its state in ps, then resume it.

  4. 4

    Check whether PID 1 exists and whether you may signal it, without sending anything.

Related commands

pkillFind or signal processes by pattern (pgrep / pkill)killallSignal every process with a given namepsSnapshot the running processesjobsList the shell's background and stopped jobssystemctlStart, stop, enable and inspect systemd services
PrevioushtopNextkillall
Linux / Process Management / kill

kill

Send a signal to a process

Beginneressentialsignalsprocesses

kill sends a signal to a process by PID. Despite the name, the default signal, SIGTERM, is a polite request to shut down; SIGKILL (-9) is the forced, uncatchable version, and SIGHUP is how many daemons are told to reload their config.

Syntaxkill [-s SIGNAL | -SIGNAL] PID|%JOB... kill -l [NUMBER]

Watch it run

You need to stop the Node app that was started by hand, and let it finish its in-flight requests.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 4
pgrep -a node

First get the PID. pgrep -a prints the PID and the full command line, so you can be sure it is the right process.

Anatomy of a command

$
commandkill

Usually the bash builtin (so it also understands %job), otherwise /usr/bin/kill from util-linux.

How it works

kill is a thin wrapper around the kill(pid, sig) system call. The kernel first checks permission: your real or effective UID must match the target's, or you need CAP_KILL (root). It then marks the signal pending on the target and wakes it if it is sleeping interruptibly. When the target next returns to user mode, the kernel runs its handler if it installed one with sigaction, or the default action: terminate (TERM, INT, HUP), terminate with a core dump (QUIT, SEGV, ABRT), stop (STOP, TSTP) or ignore (CHLD, WINCH). SIGKILL and SIGSTOP can't be caught or ignored: the kernel acts directly. A process in D state (uninterruptible I/O) only dies when the I/O returns. When a process dies of a signal, its parent sees exit status 128 + signal number: 143 for TERM, 137 for KILL.

kill asks the kernel to mark a signal pending; the target's handler or the default action decides what happens next.

typekill(2051,15)set pendingcaughtnot caughtSIGCHLDYoukill 2051bashkill builtinKernelpermission checknode 2051runningTERM handlerdrain, exit 0Default actionterminateParentwait() status
1/8
You run kill 2051

kill is a bash builtin. With no signal given it sends SIGTERM, number 15.

← → to step

Options you'll actually use

(none)Send SIGTERM (15): ask the process to exit cleanly
-9 / -KILLSIGKILL: kernel ends the process now; no cleanup, no handler
-1 / -HUPSIGHUP: terminal hung up; many daemons reload config on it
-2 / -INTSIGINT: what Ctrl-C sends
-3 / -QUITSIGQUIT: exit with a core dump (Java prints a thread dump)
-STOP / -CONTPause a process (uncatchable) / resume it
-USR1 / -USR2App-defined: reopen logs (nginx USR1), dump state ...
-0Send nothing; only check that the PID exists and you may signal it
-l [N]List signal names, or translate a number (kill -l 137 = KILL)
-- -PGIDSignal every process in a process group

Common mistakes

Reaching for kill -9 first

SIGKILL skips every cleanup: open transactions, temp files, PID files and locks are left behind, and buffered data is lost.

kill PID, wait 5-10 s, and only then kill -9 PID
kill -9 on a process stuck in D state, then again and again

A task in uninterruptible sleep can't act on any signal until its I/O completes. The kill is queued, not ignored.

Find the stuck mount or device (cat /proc/PID/stack, dmesg) and fix that
kill $(pidof myapp) in a script without checking

If nothing matches, kill gets no arguments and prints a usage error; if a PID was reused, you hit the wrong process.

pkill -x myapp, or systemctl stop myapp for services
kill -HUP on any daemon to 'reload' it

HUP's default action is terminate. Only programs that install a HUP handler (nginx, sshd, rsyslog) reload; others just die.

Check the docs, or use systemctl reload SERVICE which knows the right method

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Start `sleep 600 &`, then stop it with the default signal and confirm it's gone.

  2. 2

    Find out which signal number SIGUSR1 has, and which signal exit code 143 means.

  3. 3

    Pause a running `sleep 600 &` with a signal, check its state in ps, then resume it.

  4. 4

    Check whether PID 1 exists and whether you may signal it, without sending anything.

Related commands

pkillFind or signal processes by pattern (pgrep / pkill)killallSignal every process with a given namepsSnapshot the running processesjobsList the shell's background and stopped jobssystemctlStart, stop, enable and inspect systemd services
PrevioushtopNextkillall