Use kill PID to signal one known process, pkill to select processes by a pattern and attributes, and killall to target processes by command name. Each defaults to SIGTERM, which gives a program an opportunity to save data and release resources. Verify the target first, wait briefly, and use SIGKILL (kill -9) only when a confirmed process will not exit normally.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
kill, pkill or killall: which command should you use?
| Goal | Command pattern | How targets are selected | Main caution |
|---|---|---|---|
| Stop one known process | kill PID |
One exact process ID | Confirm the PID; the default signal is SIGTERM. |
| Stop selected matches | pkill pattern |
An extended regular expression plus filters such as user, parent, group, terminal, age, exact name or full command line | The default process-name field is limited to 15 characters. Use -x or -f deliberately. |
| Stop every process with a command name | killall name |
Command name, with optional regular-expression, user, namespace, age, group and interactive filters | A short or broad name can match several processes. |
The commands are selectors, not different kinds of signals. By default, all three send SIGTERM (signal 15). Their important difference is how they decide which processes receive it.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What a Linux signal does
A signal is a small asynchronous notification delivered to a process or process group. The receiving program may handle, block or ignore many signals. SIGTERM is the conventional orderly-shutdown request: a program can close files, flush saves, remove temporary data, close sockets and then exit.
SIGKILL is signal 9. The kernel terminates the target immediately, and the target cannot catch, block or handle it. That removes any opportunity for cleanup, so a forced kill can leave a lock file, partial save, interrupted database transaction or open-session state behind. A normal escalation is therefore:
#1 Best Overall
- Send SIGTERM and allow the application time to shut down.
- Check whether the same process is still present.
- Send SIGKILL only after reconfirming the identity and accepting the cleanup risk.
You can name a signal (TERM, KILL), prefix it with SIG, or use its number. For example, kill -TERM 4821, kill -SIGTERM 4821 and kill -15 4821 request the same signal. kill -l lists names supported by the current environment.
Inspect the process before sending anything
A PID can be reused after a process exits. Never copy a PID from an old terminal line and assume it still identifies the same program. Inspect the current process table immediately before signaling:
ps -eo pid,user,ppid,pgid,stat,comm,args --sort=pidFor a narrower view, search by the account that owns the process:
pgrep -a -u "$USER" gameThe -a option prints the PID and command line. Treat the output as a preview, not as permission to kill every line that looks similar. Confirm the PID, executable or command line, owner, parent and, when relevant, process group. A game launcher, compatibility layer and game executable can be separate processes; terminating the launcher may not stop the child, while a pattern aimed at the child could match several sessions.
If you only need to test whether a PID exists and you are allowed to signal it, signal number zero performs a permission and existence check without delivering a terminating signal:
kill -0 4821A successful command does not mean the process is healthy; it means the kernel accepted the existence and permission check. An error such as “No such process” means the PID is gone, while “Operation not permitted” points to an identity, capability or namespace boundary.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Stop one known process with kill
Graceful termination
Once you have verified the current PID, send the default request:
kill 4821Being explicit can make scripts easier to audit:
kill -TERM 4821The kill utility sends the selected signal to specified processes or process groups. It does not mean “force close” by itself. A well-behaved application handles SIGTERM and exits in an orderly fashion.
Wait and verify
There is no universal delay that suits every program. A graphical game may need time to write a save, while a small command-line helper should disappear almost immediately. Recheck the process rather than blindly issuing another command:
ps -p 4821 -o pid=,user=,stat=,comm=,args=If the command prints nothing, that PID no longer exists. If it remains, inspect its state and decide whether more time, a different signal or a service-level fix is appropriate.
Force termination only as a last resort
After reconfirming that PID 4821 is still the intended target, use:
kill -KILL 4821or:
kill -9 4821SIGKILL cannot be caught and gives the process no cleanup opportunity. It also cannot make an uninterruptible kernel wait complete immediately; a task stuck in an uninterruptible state may remain visible until the underlying I/O returns. If the process is a child of a supervisor, it may also be started again after either signal.
Use pkill when selection needs a pattern or filters
pkill sends the selected signal to every process matching its criteria. Its pattern is an extended regular expression applied to the process name by default. For example:
pkill -TERM -x game-client-x requires the process name to match exactly. Without it, a pattern can match names containing the expression. The default name is the kernel’s process-name field, which is limited to 15 characters. Long executable names may therefore be indistinguishable when only the default name is examined.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Match the complete command line with -f
Use -f when the distinguishing text appears in arguments or when the executable name is truncated:
pkill -TERM -f 'server --port 27015'Full command-line matching is powerful and correspondingly easier to overmatch. Quote the expression so the shell does not reinterpret it, and preview it first where practical:
pgrep -a -f 'server --port 27015'Then run the equivalent pkill only if every listed process is intended.
Constrain pkill by identity and relationships
Pattern matching can be combined with attributes. Common examples include selecting a user with -u, a parent process with -P, a process group with -g, a terminal with -t, or an exact name with -x. These filters are useful when several users run similarly named game servers or when a launcher and its children share part of a command line.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
pkill -TERM -u player -x game-serverRead the local pkill manual for the exact option spelling supported by your procps-ng version. A successful pkill can affect more than one PID; its contract is to signal each matching process rather than print a list.
Use killall for intentional command-name-wide action
killall selects processes by command name. This is appropriate when every instance of a named service or helper should stop:
killall -TERM game-serverIt is not a synonym for “kill one process.” If three users run game-server, all three can receive the signal unless you narrow the selection.
Useful killall narrowing and confirmation options
-u userlimits matches to a user.-g groupselects processes in a process group.-n secondsselects processes newer than the specified age.-o secondsselects processes older than the specified age.-y secondsselects processes younger than the specified age.-erequests exact matching, including handling for names longer than the usual displayed command-name field.-iasks for interactive confirmation before terminating each match.
For example, an account-scoped, interactive stop is less surprising than a machine-wide name match:
Free tools Windows power users keep installed
One-click scans. No signup required.
killall -TERM -u player -i game-serverCheck the installed manual because option combinations and namespace behavior depend on the psmisc version. A broad name should never be placed in an unattended script without an additional identity or age constraint.
Why killall -w can hang
The -w option waits for processes to disappear and checks roughly once per second. The wait can last forever if a process ignores the signal, the signal has no effective result, or the process remains a zombie. It also has a race: a PID can disappear and be replaced between scans, so waiting is not a perfect identity guarantee. Use it only when an indefinite wait is acceptable and the process lifecycle is understood.
Choosing between pkill and killall
Use pkill when the distinction is a pattern plus process metadata: a particular account, parent, process group, terminal, age or full command line. Use killall when the operational intent is expressed as a command name, especially when all instances of that name should receive the signal. Neither command is inherently safer; safety comes from making the match narrower than the set of processes you are willing to stop.
For a long executable name, first determine whether the visible name is truncated. A default pkill match can see only the first 15 characters, so two programs with the same prefix may be indistinguishable. Switching to -f and including a distinctive argument can separate them. Conversely, full command-line matching sees arguments from every matching process, so a short expression such as server can select far more than the intended instance. An exact -x name match or an account filter is preferable when it expresses the requirement clearly.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitcheskillall also supports regular-expression and namespace-related selection on implementations that provide those options. The -e and -i choices are useful safeguards when a command name is long or when a human should approve each match. Always check the installed manual: killall is provided by psmisc, while pkill is part of procps-ng, and option details can vary by version.
Rank #4
Process groups, special PIDs and signal zero
kill can target more than one process through process-group semantics:
- PID
0refers to the caller’s current process group. - A negative value below
-1refers to the process group whose ID is the absolute value. For example,kill -- -7310signals process group 7310; the--prevents the negative number being parsed as an option. - A positive PID addresses one process.
- Signal
0delivers no signal but checks whether the target exists and whether signaling would be permitted.
Group operations are useful for a foreground job or a deliberately isolated server, but they can terminate every member of that group. Inspect the PGID column before using a negative target.
Be especially careful when combining a group target with SIGKILL. A process group can contain a shell, launcher and worker processes, so one command may remove all of them without giving any member a chance to clean up. If only one worker is intended, address its positive PID instead.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Permission errors, namespaces and vanished PIDs
Linux permits a signal when the sender has the required identity relationship with the target or has the CAP_KILL capability in the target process’s user namespace. In practical terms, a regular account normally signals its own processes; signaling another account’s process generally requires appropriate privilege. Containers and other PID namespaces can make a process visible from one context but not another, so run inspection and signaling in the namespace where the target exists.
Common failures have distinct meanings:
- “Operation not permitted” (EPERM): the caller lacks the required credentials or capability, or the namespace boundary prevents the operation.
- “No such process” (ESRCH): the process already exited, the PID was never valid in this namespace, or a race occurred between inspection and signaling.
- No visible change after SIGTERM: the program may be handling shutdown, stuck in an uninterruptible wait, or immediately restarted by a supervisor.
Do not respond to EPERM by automatically adding sudo. First verify that the process is the one you intend to stop and that terminating another user’s workload is authorized.
Race-safe signaling and version details
Shells commonly provide a builtin kill. To identify the external util-linux implementation, run:
/bin/kill --versionCurrent util-linux documentation describes PID:inode references for race-resistant signaling on Linux kernel 6.9 or later. It also documents --timeout, which sequences follow-up signals while tying them to the same process identity. These facilities are useful in automation where a PID could otherwise be reused between a graceful signal and a later force signal.
pkill can use a pidfd-based signaling path when it can obtain a process file descriptor. That reduces ambiguity compared with constructing a later command from a bare PID, but it does not remove the need to choose a safe pattern.
On systems without those identity-aware facilities, keep inspection and signaling as close together as possible. Do not save a PID in one script step, perform unrelated work for several minutes, and then send SIGKILL without checking the command and owner again. A newly created process may have inherited the old number.
Best Value
Reliable workflows for common situations
A frozen game or graphical application
- Find the process with
psorpgrep -a, and confirm the owner and command line. - Send
kill -TERM PID. - Wait while watching the same PID.
- If it remains and you have confirmed the identity again, send
kill -KILL PID. - Check for a restart by a launcher or service before assuming the signal failed.
Several instances of a server
- Preview with
pgrep -a -u account pattern. - If only one command line is intended, use
pkill -fwith a distinctive, quoted expression. - If every instance for one account should stop, use
killall -u account -i name. - Inspect the result and logs rather than repeating a broad command.
A script that must escalate
Store and validate the process identity as close as possible to the signal operation. Prefer pidfd or the util-linux identity-aware features on systems that support them. If those are unavailable, re-run a precise inspection before escalation; never assume the original PID still belongs to the same program.
A process that will not disappear
First inspect its state rather than repeating kill -9. An uninterruptible wait can keep a task visible until an underlying I/O operation completes, and a zombie is already terminated but waiting for its parent to collect its status. In either case, another terminating signal may not change what you see. If a supervisor recreates the process, stopping the child alone will also appear ineffective because a replacement quickly receives a new PID.
Common mistakes to avoid
- Using
kill -9first: SIGKILL prevents cleanup and can leave application state inconsistent. - Assuming a name identifies one process: launchers, workers and different users can share a command name.
- Ignoring the 15-character limit: default
pkillmatching may not distinguish long names. - Using an unquoted full-command pattern: shell metacharacters can change the expression before
pkillsees it. - Escalating from a stale PID: PID reuse can make a later command hit an unrelated process.
- Expecting
killall -wto prove identity: it polls once per second and has a replacement race. - Assuming success means shutdown: the signal may have been accepted while a supervisor immediately restarted the program.
Checklist before pressing Enter
- Did you inspect the current PID, command, owner and process group?
- Is the selector exact, or can it match launchers, helpers or another user’s instance?
- Have you tried SIGTERM first?
- Have you allowed enough time for normal cleanup?
- Would SIGKILL risk losing saves, files, sockets or other state?
- Could a supervisor restart the process?
- Are you operating in the correct user and PID namespace?
- If using
killall -w, can you safely tolerate an indefinite wait?
The safest default remains simple: inspect, select narrowly, send SIGTERM, verify, and escalate only to a confirmed target when graceful shutdown has genuinely failed.
Frequently Asked Questions
How do I kill one process by PID?
Inspect the PID, then run kill PID or the explicit kill -TERM PID. Wait and verify that the same process has exited before considering kill -KILL PID.
What is the difference between kill, pkill and killall?
kill addresses a PID or process group. pkill selects processes with a pattern and filters such as user, parent, group or terminal. killall selects by command name and can signal every matching instance.
Should I always use kill -9?
No. SIGKILL cannot be caught or handled, so the program cannot save files, close sockets or clean up. Send SIGTERM first and use SIGKILL only for a confirmed process that will not shut down normally.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why did pkill kill more than one process?
Its pattern is applied to every matching process, not just the first. The default name can also be broad, and it is limited to 15 characters. Preview with pgrep -a, then use -x, -f and identity filters deliberately.
Why did killall stop several users’ processes?
killall name matches the command name across the visible namespace. Add -u user, use an exact or narrower match, and consider -i for interactive confirmation.
What does kill -0 do?
Signal zero delivers no terminating signal. It checks whether the PID exists and whether your process would be permitted to signal it. It does not prove that the target is healthy or that the PID will not be reused later.
Why does killall -w wait forever?
The option checks roughly once per second and can wait indefinitely if the process ignores the signal, the signal has no effective result, or the process remains a zombie. A PID can also disappear and be replaced between checks.
What does Operation not permitted mean when killing a process?
The caller lacks the required user-ID relationship or CAP_KILL capability, or a namespace boundary prevents the operation. Verify ownership and namespace before adding privilege.
The Bottom Line
Inspect the current target, choose the narrowest selector, send SIGTERM, and verify the result. Reserve SIGKILL for a reconfirmed process whose graceful shutdown has failed, and treat broad pkill, killall and process-group commands as multi-process operations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
