Doubts in Kill command

Posted on 2006-10-31
Medium Priority
Last Modified: 2013-12-27
Hello Experts,

I have few doubts in using KILL command. Please clarify me.

1. What is the difference between the Kill signal: -9 & -15 ?  which one is advised to use for killing a process? In what situation, we should use each one?

2. What is the difference between PKILL and KILL ?

3. kill -HUP <in.named> -  Will this kill the DNS service and restart it by re-reading the config file? Will it make any difference if I kill in.named and restart it?

4. What is the usage of -INT signal?

5. I came across about using -USR1 and -USR2 signals for debugging. What it means, in what scenario it will be used? My doubt is, debugging requires the process to run. But if you kill it, how can we do debugging?

Thanks in advance.

Question by:rdashokraj
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Author Comment

ID: 17847755
Forgot to ask one more doubt......

6. How can I kill a parent process along with all its child processes? In other words, how can I kill a process along with all its related processes ?

LVL 38

Expert Comment

ID: 17847978
for information about your system signals have a look at /usr/include/sys/signal.h file

and this doc:

-INT  == ctrl C (from keyboard)

man kill
man pkill
to learn the difference. (the "man" is your friend in Unix)

To get parent process  and pid you can do use ps with -o option, eg:
ps -e -o pid,ppid,pgid,user,vsz,rss,args

man ps
to learn more details (so you can format the ps out the way you wanted).


Accepted Solution

jhartzen earned 800 total points
ID: 17848698
Hello Ashok.
The first thing to understand is that the kill (and pkill) command is somewhat misnamed.  A better name would have been "send_signal_to_process".  The kill and pkill commands sends a signal to the specified process.

In Solaris and most other unix flavours, the default signal is signal 15, also known as SIGTERM, which by defaults makes the process quit, hence the name of the command.  As a general rule, a program (process) will "handle" the signal by executing some code, or else a default handler provided by the OS will be executed.  A custom handlermakes up part of the process program, and does whatever the developer wished (at least that is the theory - some programmers are more succesfull than others in making their code do what they wish).  The general agreed handling of signal 15 is for the program to quit, performing all of its required cleanup, including gracefuly closing files, network sessions, and stopping any other in-progress transactions it may be busy with.  How it does this depends on the code written by the program's developer(s)

Another common use is to use the HUP signal (signal nr 1) to make the process re-read its configuration files.  This is just the unix way - re-use an existing signal for a new purpose.  The original use of HUP was to inform a running process, particularly a shell session, that the user connection was disconnected (Hung Up).  The shell could then do things such as run the ".logout" script in the user's home directory.  Nowadays it is much more common for the HUP signal handler to just re-read the program's configuration files and to then in some way respond to any changed config settings, maybe closing a LOG file in one location and opening a log file in another location.  As a rule the process will not quit and restart, but that could actualy be done through the handler of the HUP process if the programmer thought that to be the best way to handle "config changes".

You can see the list of signals in the man page displayed by this command:
man signal.3head

Now with that background, to give you more specific answers to your questions

1. What is the difference between the Kill signal: -9 & -15 ?  which one is advised to use for killing a process? In what situation, we should use each one?

Signal 9 is special.  Processes cannot trap or handle or ignore signal 9.  Signal 9 will be handled by the scheduler and it will remove the process from memory and release all of its resources, such as open files.  There is one exception:  If a process has got hung IO, then the memory will be freed and the process will be denied any more CPU time (removed form the scheduling queue).  But the process entry will remain in the process table until the IO completes.  This can sometimes take a little while, eg a rewinding tape device, sometimes it can take very long (the NFS service by default have a timeout period of many thousands of years), and sometimes it might never return, eg in the case of a faulty IO device.

Signal 15 on the other hand allows the process to shut itself down gracefully.  The scheduler would still keep the process entry in the process table untill all of its IO has completed, but the disadvantage is that the process could fail to quit if, for example, the signal handler depends on something which is unavailable.  Closing could also take time, depending on how much processing is needed, etc.  And of course, processes can chose to ignore signal 15.

You can see whether a signal is ignored by using the psig command.  This command prints a list telling you what the programmer did with each signal.  Default means the process does not have a custom handler for the signal, so it will let the OS decide what to do.  Ignored means the signal will be discarded. Caught means the programmer has written some custom code to handle the signal.  The KILL signal (signal 9) cannot be caught or ignored.

I would advise that you always try signal 15, the default, and if it fails to terminate the program, then try signal 9.

2. What is the difference between PKILL and KILL ?

pkill is just a convenient way of searching for a process and then sending the specified signal.  With kill, you need to search for a process, identify its PID, then send the signal to that PID.  With pkill you can use search tems, eg to search for any process belinging to a specific user or for processes containing a specified string in the command.

3. kill -HUP <in.named> -  Will this kill the DNS service and restart it by re-reading the config file? Will it make any difference if I kill in.named and restart it?
No and No.  The named daemon will not actually restart, it will just reread its config files.  terminating and restarting the process will have pretty much the same effect, except that you will end up having a new process with 0 CPU time and a start time of when you restarted it.

4. What is the usage of -INT signal?
This is traditionally the Control-C break sequence.  Some processes "ignore" this signal, eg vi, but also some processes give you a second chance, eg "mail" will tell you to type CTRL-C again to realy break.  The process should go through cleanup before it actually quits, though how often this is actually properly implemented is anybody's guess.

5. I came across about using -USR1 and -USR2 signals for debugging. What it means, in what scenario it will be used? My doubt is, debugging requires the process to run. But if you kill it, how can we do debugging?

I think much of what I've explained above will answer this question.  Most importantly, the kill command doesn't actualy kill the process.  In the case of kill -9, it is the OS, and in the case of un-handled Signal 1, Signal 2 or Signal 15, it is also the OS (the scheduler to be more exact) that kills the process.  In all cases, kill merely submits a signal.  The user should "trap" the signals and make the perform debugging work, by writing routines which will be executed when that signal is recieved.

In essence, when a process starts up, it "registers" (at least it should if it doesn't want a default handler to be applied) a function to be executed when it receives a signal.  After this, any time that signal is received, the process will jump to the relevant registered function.

I hope this cleared up some confusion.

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Expert Comment

ID: 17848723
I jsut noticed the second part of your question: About killing a process with all of its child processes: When a parent or child process exists, some signals are automatically generated.  Sometimes the process will handle these, and sometimes the process will ignore these.  You are at the mercy of what the developer decided to do in each case.

The only way to ensure that you get what you want would be to first make a list of all the PIDs, including the parent and all of its children, and then send the TERM or KILL signal to each of these.

To get a list of processes, including child but not sub-child processes, use this:
ps -ef|grep PARENT-PID |awk '{print $2}'

To automatically kill these, you can pipe this further through:
 .... | xargs kill

If you want to include sub-child processes as well, it becomes a bit tricker, but that is becoming a new question topic.
LVL 48

Assisted Solution

Tintin earned 200 total points
ID: 17853054
jhartzen has given some very good detailed answers.

I'll just pick on two points:

3.  There is an important different between sending SIGHUP to in.named and stopping and restarting it.  Sending a SIGHUP doesn't interrupt the process.  Restarting in.named causes the DNS cache to be lost and it resignals to any slave servers to check for updates.

6.  If you want to kill a parent and child processes then you can do

pkill -P <parent pid>

Author Comment

ID: 17855687

Thanks a lot for your wonderful explanation !!!  I'm delighted for having got a clear idea about using KILL command :)

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

My previous tech tip, Installing the Solaris OS From the Flash Archive On a Tape (http://www.experts-exchange.com/articles/OS/Unix/Solaris/Installing-the-Solaris-OS-From-the-Flash-Archive-on-a-Tape.html), discussed installing the Solaris Operating S…
Introduction Regular patching is part of a system administrator's tasks. However, many patches require that the system be in single-user mode before they can be installed. A cluster patch in particular can take quite a while to apply if the machine…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question