Killing a process from the Command Line in Linux

When a computer becomes unresponsive, it’s often because a process is monopolizing your system resources. An easy solution to this problem is to kill the resource-heavy process. But before we can kill a process, we need to understand what it is.

A process is an instance of a program in execution, along with everything it needs for that execution. A share of system resources is allocated to the process so that it can load the contents of the file it reads—or the input/output devices, along with everything else—into allocated memory. It then uses the allocated CPU cores to run.

But some processes behave in unexpected ways. For instance, a program may encounter an error in its code and start consuming excessive memory. Similarly, processes can consume 100% of the CPU cores. When this happens, the computer becomes unresponsive because that one rogue process is taking up all of the system resources.

"Killing" that process frees up resources so that the system can come back to the normal state. To kill a process requires a unique identifier that’s allocated to each process when it's started. This is called a process ID, or PID for short. All the resources allocated to the processes are referenced against this number, so finding the PID is the your first step in killing the process and making system resources available.

In this article, we’ll walk you through the process of finding the PID for a given process and then killing the process using a few simple commands.

top: The command to assess system resource usage and availability

top is a popular command for accessing system resource utilization. The command will generate a table that includes a live list of all the processes running, each process ID, the percentage of resources that process is using, and more. You can see the user interface of the top command in the figure below.

By default, processes are sorted based on the percentage of CPU they are using in descending order, so the first process you see is one consuming the most CPU. In this example, we can see that the Webkit process is using a little over 105% of the CPU. This is because when the screenshot was taken, the Safari web browser was running with a few tabs playing videos of various formats.

In addition to “%CPU,” monitoring the "MEM" column is also important, as it lets you know how much memory or RAM is being used by the process.

“%CPU” and “MEM” are two of the most important columns to monitor in this table.

How to locate and kill processes in Linux

Now that we can identify a process that's consuming more CPU or memory by using the top command, let's see how we can kill such a process.

First, we can get the ID of the process we want to kill from the first column in the table shown in figure 1. Be aware that the list is continuously updating—every three seconds for Linux and every one second for MacOS—so it might be difficult to identify both the process and the PID in that short window. Fortunately, there's another command for that.

The ps command

Once we identify the process that we want to kill, we can use the ps command to get the corresponding process ID. If we run the ps command in our terminal, we don't see much in the output. The screenshot below shows that the ps command itself doesn't give much info.

Fig. 2: ps command output

But by using the three options below with the ps command, we can get a lot more:

• a: List processes from all users
• u: List the usernames as well
• x: Include processes without an attached or controlling terminal

Using these three options will list all processes running on the system at a given time. You’ll see something like the figure below:

In this example, we’ve used the extra "| head" (man7.org/linux/man-pages/man1/head.1.html) option to limit the output list to 10 items, but it’s not necessary. From the output, we can see all processes being listed.

How to find the process ID (PID) with the ps command

Now, let's suppose we have an instance of Sublime Text running that we want to kill. For this, we first have to get the Sublime Text’s PID. We will use the ps aux command for this and filter the list to only show Sublime Text instances.

We'll do the filtering using another popular command called grep. We can chain the commands using "pipe," which is represented by the | symbol. The complete command is as shown below:

ps aux | grep subl

subl is the command used to run an instance of Sublime Text. So, when we run this command, ps will only show all the instances of Sublime Text running, similar to the screenshot shown in figure 4 below.

As we can see from the output, there are three instances of the Sublime Text currently running. The first list item is the ps command itself, so we’ll ignore that. The second column is the PID of the processes.

Now we can finally kill the processes to free up system resources.

The kill command

As you might have expected, we have another command to kill processes, and the command is quite simply: kill. We pass the PID of the process we want to kill to the kill command. From figure 4 above, we have three processes to kill with the PIDs 28947, 28946, and 28940. So the command would be:

kill 28947 28946 28940

We can pass multiple PIDs to this simple killcode> command, so we don't have to individually kill each process. However, it’s important to note that the PIDs here are space separated. This will kill all three running instances of Sublime Text, which can be verified by running the ps aux | grep subl command again.

Multiple signals of the kill command

It may not always be of concern, but sometimes killing a process without telling all downstream systems will result in more processes becoming unresponsive. To avoid such situations, Linux provides a feature called “signals.”

Signals are used to signal the occurrence of an event to other processes. The kill command provides seven signals, which are shown in figure 5 below.

As you can see from the screenshot, these are the most commonly used signals. While killing a process, we can pass the numeric identifier for the signal as an option to the kill command. For example, if I want to pass the KILL signal to the kill command, I would change my command to the following:

kill -9 28947 28946 28940

The output of the command is no different than the kill command without options. The only difference is that the signal is also handled by the system. In addition to these common ones, there are other kill command options that you can experiment with.

Elevated permissions to kill processes

As you might have observed, we did not use the sudo command while killing instances of Sublime Text. This is because Sublime Text was a user process that we started. But there will be instances when we want to kill processes started by other users or by the system.

your database process unresponsive. In such cases, we need elevated permissions to kill those processes. The only difference in the command is to add "sudo" before the command itself, as shown below:

sudo kill -9 28947 28946 28940

The superuser password is required for the command to be executed, so make sure you have that handy. Unless you’re in the "sudoers" list, you will not be able to run the command and kill those processes without the password.

But killing processes as superusers requires care. Killing a system process might cause instability in the system, requiring a reboot that could cause downtime. Furthermore, killing the processes of other users might cause their apps to malfunction.

Summary

When a process is consuming excess system resources, killing it so you can get back to work may be your best option.

You can streamline the kill process by identifying resource-heavy processes with the top command, and finding their PIDs using the ps command. Once you have the PID, you can easily kill processes using the kill command or signal other processes to handle that event, if required. As noted above, however, it’s important to be careful when killing system processes or processes started by other users.