Doubts in Kill command

Posted on 2006-10-31
Last Modified: 2013-12-27
Hello Experts,

I have few doubts in using KILL command. Please clarify me.

1. What is the difference between the Kill signal: -9 & -15 ?  which one is advised to use for killing a process? In what situation, we should use each one?

2. What is the difference between PKILL and KILL ?

3. kill -HUP <in.named> -  Will this kill the DNS service and restart it by re-reading the config file? Will it make any difference if I kill in.named and restart it?

4. What is the usage of -INT signal?

5. I came across about using -USR1 and -USR2 signals for debugging. What it means, in what scenario it will be used? My doubt is, debugging requires the process to run. But if you kill it, how can we do debugging?

Thanks in advance.

Question by:rdashokraj

Author Comment

ID: 17847755
Forgot to ask one more doubt......

6. How can I kill a parent process along with all its child processes? In other words, how can I kill a process along with all its related processes ?

LVL 38

Expert Comment

ID: 17847978
for information about your system signals have a look at /usr/include/sys/signal.h file

and this doc:

-INT  == ctrl C (from keyboard)

man kill
man pkill
to learn the difference. (the "man" is your friend in Unix)

To get parent process  and pid you can do use ps with -o option, eg:
ps -e -o pid,ppid,pgid,user,vsz,rss,args

man ps
to learn more details (so you can format the ps out the way you wanted).


Accepted Solution

jhartzen earned 200 total points
ID: 17848698
Hello Ashok.
The first thing to understand is that the kill (and pkill) command is somewhat misnamed.  A better name would have been "send_signal_to_process".  The kill and pkill commands sends a signal to the specified process.

In Solaris and most other unix flavours, the default signal is signal 15, also known as SIGTERM, which by defaults makes the process quit, hence the name of the command.  As a general rule, a program (process) will "handle" the signal by executing some code, or else a default handler provided by the OS will be executed.  A custom handlermakes up part of the process program, and does whatever the developer wished (at least that is the theory - some programmers are more succesfull than others in making their code do what they wish).  The general agreed handling of signal 15 is for the program to quit, performing all of its required cleanup, including gracefuly closing files, network sessions, and stopping any other in-progress transactions it may be busy with.  How it does this depends on the code written by the program's developer(s)

Another common use is to use the HUP signal (signal nr 1) to make the process re-read its configuration files.  This is just the unix way - re-use an existing signal for a new purpose.  The original use of HUP was to inform a running process, particularly a shell session, that the user connection was disconnected (Hung Up).  The shell could then do things such as run the ".logout" script in the user's home directory.  Nowadays it is much more common for the HUP signal handler to just re-read the program's configuration files and to then in some way respond to any changed config settings, maybe closing a LOG file in one location and opening a log file in another location.  As a rule the process will not quit and restart, but that could actualy be done through the handler of the HUP process if the programmer thought that to be the best way to handle "config changes".

You can see the list of signals in the man page displayed by this command:
man signal.3head

Now with that background, to give you more specific answers to your questions

1. What is the difference between the Kill signal: -9 & -15 ?  which one is advised to use for killing a process? In what situation, we should use each one?

Signal 9 is special.  Processes cannot trap or handle or ignore signal 9.  Signal 9 will be handled by the scheduler and it will remove the process from memory and release all of its resources, such as open files.  There is one exception:  If a process has got hung IO, then the memory will be freed and the process will be denied any more CPU time (removed form the scheduling queue).  But the process entry will remain in the process table until the IO completes.  This can sometimes take a little while, eg a rewinding tape device, sometimes it can take very long (the NFS service by default have a timeout period of many thousands of years), and sometimes it might never return, eg in the case of a faulty IO device.

Signal 15 on the other hand allows the process to shut itself down gracefully.  The scheduler would still keep the process entry in the process table untill all of its IO has completed, but the disadvantage is that the process could fail to quit if, for example, the signal handler depends on something which is unavailable.  Closing could also take time, depending on how much processing is needed, etc.  And of course, processes can chose to ignore signal 15.

You can see whether a signal is ignored by using the psig command.  This command prints a list telling you what the programmer did with each signal.  Default means the process does not have a custom handler for the signal, so it will let the OS decide what to do.  Ignored means the signal will be discarded. Caught means the programmer has written some custom code to handle the signal.  The KILL signal (signal 9) cannot be caught or ignored.

I would advise that you always try signal 15, the default, and if it fails to terminate the program, then try signal 9.

2. What is the difference between PKILL and KILL ?

pkill is just a convenient way of searching for a process and then sending the specified signal.  With kill, you need to search for a process, identify its PID, then send the signal to that PID.  With pkill you can use search tems, eg to search for any process belinging to a specific user or for processes containing a specified string in the command.

3. kill -HUP <in.named> -  Will this kill the DNS service and restart it by re-reading the config file? Will it make any difference if I kill in.named and restart it?
No and No.  The named daemon will not actually restart, it will just reread its config files.  terminating and restarting the process will have pretty much the same effect, except that you will end up having a new process with 0 CPU time and a start time of when you restarted it.

4. What is the usage of -INT signal?
This is traditionally the Control-C break sequence.  Some processes "ignore" this signal, eg vi, but also some processes give you a second chance, eg "mail" will tell you to type CTRL-C again to realy break.  The process should go through cleanup before it actually quits, though how often this is actually properly implemented is anybody's guess.

5. I came across about using -USR1 and -USR2 signals for debugging. What it means, in what scenario it will be used? My doubt is, debugging requires the process to run. But if you kill it, how can we do debugging?

I think much of what I've explained above will answer this question.  Most importantly, the kill command doesn't actualy kill the process.  In the case of kill -9, it is the OS, and in the case of un-handled Signal 1, Signal 2 or Signal 15, it is also the OS (the scheduler to be more exact) that kills the process.  In all cases, kill merely submits a signal.  The user should "trap" the signals and make the perform debugging work, by writing routines which will be executed when that signal is recieved.

In essence, when a process starts up, it "registers" (at least it should if it doesn't want a default handler to be applied) a function to be executed when it receives a signal.  After this, any time that signal is received, the process will jump to the relevant registered function.

I hope this cleared up some confusion.

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.


Expert Comment

ID: 17848723
I jsut noticed the second part of your question: About killing a process with all of its child processes: When a parent or child process exists, some signals are automatically generated.  Sometimes the process will handle these, and sometimes the process will ignore these.  You are at the mercy of what the developer decided to do in each case.

The only way to ensure that you get what you want would be to first make a list of all the PIDs, including the parent and all of its children, and then send the TERM or KILL signal to each of these.

To get a list of processes, including child but not sub-child processes, use this:
ps -ef|grep PARENT-PID |awk '{print $2}'

To automatically kill these, you can pipe this further through:
 .... | xargs kill

If you want to include sub-child processes as well, it becomes a bit tricker, but that is becoming a new question topic.
LVL 48

Assisted Solution

Tintin earned 50 total points
ID: 17853054
jhartzen has given some very good detailed answers.

I'll just pick on two points:

3.  There is an important different between sending SIGHUP to in.named and stopping and restarting it.  Sending a SIGHUP doesn't interrupt the process.  Restarting in.named causes the DNS cache to be lost and it resignals to any slave servers to check for updates.

6.  If you want to kill a parent and child processes then you can do

pkill -P <parent pid>

Author Comment

ID: 17855687

Thanks a lot for your wonderful explanation !!!  I'm delighted for having got a clear idea about using KILL command :)

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Attention: This article will no longer be maintained. If you have any questions, please feel free to mail me. Please see for the updated article. It is avail…
Why Shell Scripting? Shell scripting is a powerful method of accessing UNIX systems and it is very flexible. Shell scripts are required when we want to execute a sequence of commands in Unix flavored operating systems. “Shell” is the command line i…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question