Under Linux, there are a maximum of 65,536 different PIDsyou cannot have more than 65,536 processes running at once. Under Ubuntu, the default maximum is 32,768 PIDs. (See “Tuning Kernel Parameters” later in this feature; this parameter’s name is kernel.pid_max.) Any new process is assigned the next available PID. As a result, it is possible to have a new process start with a lower PID than some older process. You can use the PID to kill processes using the kill command. For example to kill PID 123 use kill 123. The kill command can also be used to suspend processes (kill -STOP 123) and continue paused processes (kill -CONT 123). However, some processes do not die immediately.
Note: Technically, PIDs are handles to processes and not actual processes. A multi-threaded process may have one handle for all threads, or one handle per thread. It all depends on how the process creates the threads.
Every process is assigned a dynamic PID, but there are two exceptions: kernel and init. The kernel uses PID 0 and is not listed by ps, top, or the System Monitor. You cannot kill the kernel (with the kill command). The init process is the master parent process. Every process needs a running parent (PPID) to receive return codes and status from children. If a process’ parent dies, then init becomes the parent.
Warning: While you can kill init (sudo kill -9 1), you don’t want to do this! Killing init will eventually crash the system since init is used to clean up dead processes.
Killing a process kills it once; the kill signal does nothing to prevent the process from being started up again. In addition, there are some processes that cannot be killed.
- Zombies:—When a process dies, it returns an error code to its parent (PPID). A dead PD whose return code has not yet been received by its parent becomes a zombie. Zombies take up no CPU, but do take up a PID. For programmers, calling the wait() function retrieves return codes and kills zombies. In contrast, sending a kill signal to a zombie does nothing since the process is already dead.
- /O Bound—A process that is blocked on a kernel driver call may not process the kill signal until the kernel call returns. This is usually seen with network file system calls (NFS) when the network is down or on disk I/O when the drive is bad. For example, if you are using an NFS mounted directory and run ls, the command may hang if the network mount is bad. Sending a kill signal to the ls process will not immediately kill it. I’ve also experienced these hangs when using dd to copy a disk that was in the middle of a head-crash.
- Interception—Some kill signals can be intercepted by applications. For example, programs can intercept the default signal (kill, kill -15, or kill TERM). This is usually done so the program can clean up before exiting. Unfortunately, some programs don’t die immediately. Other kill signals, such as kill KILL or kill -9, cannot be intercepted.
Tip: If you really want to kill a process, first use kill PID (e.g., kill 1234). This sends a TERM signal and allows well-behaved processes to clean up resources. If that does not get the result you want, try kill -1 PID. This sends a hang-up signal, telling the process that the terminal died. This signal is usually only intercepted by well-behaved processes; other processes just die. If that does not kill it, then using kill -9 PID. This is a true kill signal and cannot be intercepted by the process. (Kill -9 always reminds me of Yosemite Sam shouting, “When I say whoa, I mean WHOA!”)
Signals: Night of the Living Dead
Each signal is associated with a long name, short name, and number. The most common signals are:
- SIGHUP, HUP, 1—This is a hang-up signal that is sent to processes when the terminal dies.
- SIGINT, INT, 2—This is an interrupt signal. It is sent when the user presses Ctrl+C.
- SIGKILL, KILL, 9—The true kill signal. This cannot be intercepted and causes immediate death.
- SIGTERM, TERM, 15—This is a request to terminate signal and is the default signal sent by the kill command. Unlike KILL, TERM can be intercepted by the application.
- SIGSTOP, STOP, 19—This signal stops the process but does not terminate it. This is sent when you press Ctrl+Z to halt the current process.
- SIGCONT, CONT, 18—This resumes a process that is suspended by SIGSTOP. For a paused process at the command line (Ctrl+Z), typing fg will continue the process in the foreground and bg will continue the process in the background.
- SIGCHLD, CHLD, 17—Programmers who write spawning applications use this signal. CHLD is sent to the parent whenever any child dies.
The full list of signals is in the man page for signal (man 7 signal). Any of these representations can be used by the kill command. Typing kill -9 1234 is the same as kill -KILL 1234 and kill -SIGKILL 1234.
Signals are flags; they are not queued up. If you send a dozen TERM signals to a process before the process can handle them, then the process will only receive one TERM signal. Similarly, if a program spawns six children and all die at once, then the parent may only receive one CHLD signal. If the parent fails to check for other dead children, then the remaining children could become zombies.
Killing All Processes
Every developer I know has, at one time or another, created a spawning nightmare. Sometimes killing a process only makes another process spawn. Since spawning happens faster than a user can run ps and kill, you won’t be able to kill all of the processes. Fortunately, there are a couple of options.
- Kill by name—If all the processes have the same name, you can kill them all at once using killall. For example, if my process is called mustdie, then I can use killall -9 mustdie to end all running instances of it.
- Kill all user processes—There is a special kill command that will end all processes that you have permission to kill: kill -9 -1. As a user, this kills all of your processes, including your graphical display and terminals. But it will definitely kill any spawning loops you may have running.
Note: Technically, the process ID -1 is a special case for the kill command. This means kill everything except the kill command (don’t kill yourself) and init (don’t kill the default parent).
Warning: Never use kill -9 -1 as root! This will kill every processincluding shells and necessary system applications. This will crash your system before you can take you finger off the Enter key. If you need to kill all processes as root, use the power button or use the reboot or shutdown commands—don’t use kill -9 -1.
- Stop processesInfinite spawning loops usually happen because one process detects the death of another process. Instead of killing the processes, use the stop signal: kill -STOP PID or killall -STOP Name. This will prevent further spawning and enable you to kill all the sleeping processes without them re-spawning. Continued…