CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Process Management / killall

killall

Signal every process with a given name

Beginnersignalsprocesses

killall (from psmisc) sends a signal to every process whose name matches exactly, so you don't have to look up PIDs. It can ask before each kill, wait for processes to die, and filter by user or age. On Linux it is safe; on old Solaris it really did kill everything.

Syntaxkillall [-s SIGNAL | -SIGNAL] [-u USER] [-i] [-w] [-v] [-o AGE] NAME...

Watch it run

A cancelled backup left several rsync processes running. Stop them all and wait until they are really gone.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 3
pgrep -l rsync

Three rsync processes, all from the cancelled job. Checking first is cheap and avoids surprises.

Anatomy of a command

$
commandsudo

Needed when the processes belong to another user (here: deploy).

How it works

killall walks /proc like ps does. For each PID it reads the process name from /proc/PID/stat (the comm field, which the kernel truncates to 15 characters) and compares it with the name you gave. For names longer than 15 characters it also checks the program name in /proc/PID/cmdline, and -e demands an exact match there. -u compares the owner UID, -o and -y compare the start time. For every match it calls kill(pid, sig) with SIGTERM unless told otherwise. With -w it then polls once a second until none of the signalled PIDs exist, which is useful before restarting something. If nothing matched, or every kill failed, it prints 'NAME: no process found' and exits with status 1.

Options you'll actually use

-s SIG / -SIGSignal to send (default TERM): -HUP, -9, -s USR1
-u USEROnly processes owned by USER
-iInteractive: ask y/N before each process
-vReport every process successfully signalled
-wWait for all signalled processes to die
-eExact match for names longer than 15 characters
-ICase-insensitive name match
-rTreat NAME as an extended regular expression
-o / -y TIMEOnly processes older / younger than TIME (30s, 2h, 1d)
-qQuiet: don't complain if nothing matched
-lList known signal names

Common mistakes

killall python3 to stop your script

It matches every python3 process on the box, including system services like networkd-dispatcher and unattended-upgrades.

pkill -f 'python3 myscript.py', or killall -u $USER python3
Running killall on a Solaris or AIX box from habit

On those systems killall is a shutdown tool that kills all processes it can, not by name.

pkill NAME works the same on Linux, Solaris and BSD
Restarting a service right after killall without -w

killall returns as soon as signals are sent. The old process may still hold the port, giving 'Address already in use'.

killall -w NAME && start the service
Taking 'Killed rsync(3120)' as proof it's dead

It only means kill() succeeded. A process can catch SIGTERM, take a while, or sit in D state.

killall -w, or check with pgrep afterwards

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Start three `sleep 500 &` processes, then stop all of them with one command, reporting each kill.

  2. 2

    Start `sleep 500 &` twice and stop them with killall, asking before each one. Answer y then n.

  3. 3

    Try killall on a name that doesn't exist and print the exit status. Then do it quietly.

Related commands

pkillFind or signal processes by pattern (pgrep / pkill)killSend a signal to a processpsSnapshot the running processes
PreviouskillNextpkill
Linux / Process Management / killall

killall

Signal every process with a given name

Beginnersignalsprocesses

killall (from psmisc) sends a signal to every process whose name matches exactly, so you don't have to look up PIDs. It can ask before each kill, wait for processes to die, and filter by user or age. On Linux it is safe; on old Solaris it really did kill everything.

Syntaxkillall [-s SIGNAL | -SIGNAL] [-u USER] [-i] [-w] [-v] [-o AGE] NAME...

Watch it run

A cancelled backup left several rsync processes running. Stop them all and wait until they are really gone.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 3
pgrep -l rsync

Three rsync processes, all from the cancelled job. Checking first is cheap and avoids surprises.

Anatomy of a command

$
commandsudo

Needed when the processes belong to another user (here: deploy).

How it works

killall walks /proc like ps does. For each PID it reads the process name from /proc/PID/stat (the comm field, which the kernel truncates to 15 characters) and compares it with the name you gave. For names longer than 15 characters it also checks the program name in /proc/PID/cmdline, and -e demands an exact match there. -u compares the owner UID, -o and -y compare the start time. For every match it calls kill(pid, sig) with SIGTERM unless told otherwise. With -w it then polls once a second until none of the signalled PIDs exist, which is useful before restarting something. If nothing matched, or every kill failed, it prints 'NAME: no process found' and exits with status 1.

Options you'll actually use

-s SIG / -SIGSignal to send (default TERM): -HUP, -9, -s USR1
-u USEROnly processes owned by USER
-iInteractive: ask y/N before each process
-vReport every process successfully signalled
-wWait for all signalled processes to die
-eExact match for names longer than 15 characters
-ICase-insensitive name match
-rTreat NAME as an extended regular expression
-o / -y TIMEOnly processes older / younger than TIME (30s, 2h, 1d)
-qQuiet: don't complain if nothing matched
-lList known signal names

Common mistakes

killall python3 to stop your script

It matches every python3 process on the box, including system services like networkd-dispatcher and unattended-upgrades.

pkill -f 'python3 myscript.py', or killall -u $USER python3
Running killall on a Solaris or AIX box from habit

On those systems killall is a shutdown tool that kills all processes it can, not by name.

pkill NAME works the same on Linux, Solaris and BSD
Restarting a service right after killall without -w

killall returns as soon as signals are sent. The old process may still hold the port, giving 'Address already in use'.

killall -w NAME && start the service
Taking 'Killed rsync(3120)' as proof it's dead

It only means kill() succeeded. A process can catch SIGTERM, take a while, or sit in D state.

killall -w, or check with pgrep afterwards

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Start three `sleep 500 &` processes, then stop all of them with one command, reporting each kill.

  2. 2

    Start `sleep 500 &` twice and stop them with killall, asking before each one. Answer y then n.

  3. 3

    Try killall on a name that doesn't exist and print the exit status. Then do it quietly.

Related commands

pkillFind or signal processes by pattern (pgrep / pkill)killSend a signal to a processpsSnapshot the running processes
PreviouskillNextpkill