How to Kill a Process in Linux: top, kill, and Signals
Last published
Table of Contents
Every program running on your machine is a process, and sooner or later one of them will misbehave: a script stuck in an infinite loop, a command chewing through all your RAM, a program that just won't respond. In this post you'll learn how to see what's running with top, how to interrupt a program with Ctrl+C, and how to escalate to the kill command (and the dreaded kill -9) when a process refuses to die.
All the content from our Boot.dev courses are available for free here on the blog. This one is the "Local CLI" chapter of Learn Linux. If you want to try the far more immersive version of the course, do check it out!
Monitor Processes With top (or htop)
The top command is a powerful tool that allows you to see which programs are using the most resources on your computer.
I use the top command all the time, both on my local machine and on remote servers to diagnose performance issues. If you've ever opened up your task manager on Windows or Activity Monitor on macOS, top is similar, but for the command line.
The top command runs in a loop, updating the information every few seconds. By default, top sorts the processes by CPU usage, with the most CPU-intensive processes at the top. Another useful resource to sort by is memory (RAM) usage:
- Linux/WSL: Press M (uppercase) while
topis running. - macOS: Start
topsorted by memory withtop -o mem, or press O, then typememand press Enter while it's running.
Exit top by pressing Q.
If you want something prettier, htop is a popular alternative with a nicer interface, mouse support, and easier sorting. It usually isn't preinstalled, but it's one package manager command away, e.g. sudo apt install htop.
Ctrl+C Sends SIGINT
Sometimes a program will get stuck and you'll want to stop it. Common reasons for this are:
- You made a typo in the command and it's not doing what you want
- It's trying to access the internet but you're not connected
- It's processing too much data and you don't want to wait for it to finish
- There is a bug in the program causing it to hang
In these cases, you can stop the program by pressing Ctrl+C. This sends a "SIGINT" signal to the program, which tells it to stop.
The important word there is tells. SIGINT is short for "signal interrupt," and it's a polite request: a program can catch the signal, clean up after itself, or even ignore it entirely.
How Do You Find a Process ID (PID)?
Every process that's running on your machine has a unique ID, called a PID ("process ID"). To kill a process manually, you first need to know its PID.
The ps, "process status" command can be used to list the processes running on your machine, and their IDs:
ps aux
The "aux" options just mean "show all processes, including those owned by other users, and show extra information about each process."
To find a specific program's PID, pipe the output of ps aux into grep:
ps aux | grep program_name
You will probably get 2 results: one for the program you're looking for, and one for the grep command itself. Make sure you use the correct PID. You don't want to accidentally kill a system-critical process. The PID is the first number in the line, e.g. 93838.
How to Kill a Process by PID
Sometimes a program is in such a bad state (or is so malicious) that it doesn't respond to the SIGINT, in which case the best option is to use another shell session (new terminal window) to manually kill the program:
kill <PID>
By default, kill sends SIGTERM, another polite "please stop" signal that the program is free to catch and handle gracefully.
SIGTERM vs SIGKILL: When to Use kill -9
If the process ignores even a SIGTERM, bring out the big hammer:
kill -9 <PID>
The -9 flag sends SIGKILL, which can't be caught or ignored: the operating system terminates the process immediately, no questions asked. It's a last resort because the program gets no chance to clean up, but when a process truly won't die, SIGKILL always wins.
To recap the escalation ladder:
| Signal | Sent by | Can the program ignore it? |
|---|---|---|
SIGINT |
Ctrl+C | Yes |
SIGTERM |
kill <PID> |
Yes |
SIGKILL |
kill -9 <PID> |
No |
These commands only stick in your head when you've run them yourself a few times, which is exactly what the Learn Linux course has you do: hunting down and killing a (pretend) malicious program is one of the more satisfying assignments.
Frequently Asked Questions
What is the difference between SIGINT, SIGTERM, and SIGKILL?
SIGINT is sent by Ctrl+C and politely asks a program to stop. SIGTERM is what the kill command sends by default, and it is also a request the program can catch or ignore. SIGKILL, sent with kill -9, cannot be caught or ignored — the operating system terminates the process immediately.
What does kill -9 do?
kill -9 sends the SIGKILL signal to a process. Unlike SIGINT and SIGTERM, SIGKILL cannot be caught or ignored, so the operating system terminates the process immediately without giving it a chance to clean up. Use it as a last resort when a process ignores a normal kill.
How do I find a process ID (PID) in Linux?
Run ps aux to list all running processes, or pipe it into grep to find a specific program, like ps aux | grep program_name. The PID is the first number on each line. You will usually see two results — one for your program and one for the grep command itself, so make sure you grab the right one.
How do I kill a process running on a specific port?
Find the process using the port with lsof -i :PORT (for example lsof -i :8080), grab the PID from the output, and then run kill PID. If it refuses to die, escalate to kill -9 PID.
Why does Ctrl+C not always stop a program?
Ctrl+C sends SIGINT, which is a polite request rather than a command. Programs can catch the signal to clean up first, or even ignore it entirely. If a program will not respond to Ctrl+C, find its PID and use kill, then kill -9 if necessary.
