Linux Signals and kill Command: kill, pkill, killall, SIGTERM vs SIGKILL and trap

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: the PMT bus conductor

Why do we need this?

On a Pune PMT bus, the conductor has a few fixed signals. One bell: next stop, please get ready (polite). Two quick bells: stop right now. A long whistle: driver, wait here (pause). Another whistle: go again (continue). If the route changes, the depot radios: 'take the new route sheet' without stopping the bus. If a passenger is asleep and does not respond, the conductor cannot throw him out while the bus crosses a bridge; he waits.

What is it?

One bell = SIGTERM (15, polite stop, can clean up). Two quick bells = SIGKILL (9, cannot be refused). Long whistle = SIGSTOP. Go again = SIGCONT. New route sheet = SIGHUP (reload config). Passenger on the bridge = D-state: even SIGKILL waits until the IO finishes.

How to do it (step by step)

2. kill -l: the list of signals

Why do we need this?

You must know signal names and numbers to pick the right one and to read exit codes like 137.

What is it?

kill -l lists all signals. kill -l 9 prints the name for a number. You can use names (TERM, SIGTERM) or numbers (15). Common ones are below; numbers can differ on non-x86 systems, so names are safer.

How to do it (step by step)

1. List them.

kill -l | head -2

Output:

 1) SIGHUP	 2) SIGINT	 3) SIGQUIT	 4) SIGILL	 5) SIGTRAP
 6) SIGABRT	 7) SIGBUS	 8) SIGFPE	 9) SIGKILL	10) SIGUSR1

What it means: 64 signals in total on Linux.

2. Number to name.

kill -l 15; kill -l 137

Output:

TERM
KILL

What it means: kill -l understands exit codes too (137-128=9).

3. kill PID: send a signal

Why do we need this?

To stop or control one exact process by its PID.

What is it?

kill PID sends SIGTERM. kill -SIGNAL PID or kill -s SIGNAL PID sends another. Several PIDs at once are allowed. kill %1 targets a shell job. kill -0 PID sends nothing but checks if the PID exists and you may signal it. You can only signal your own processes unless you are root.

How to do it (step by step)

1. Polite stop.

kill 9601; sleep 1; ps -p 9601 || echo gone

Output:

  PID TTY  TIME CMD
gone

What it means: Default SIGTERM worked.

2. By name of signal.

kill -s TERM 9702 9703

Output:

(no output)

What it means: Two processes at once.

3. Is it alive?

kill -0 2201 && echo alive

Output:

alive

What it means: Common in scripts and pid-file checks.

4. Someone else's process.

kill 1420

Output:

bash: kill: (1420) - Operation not permitted

What it means: mysql owns it; use sudo.

4. SIGTERM vs SIGKILL

Why do we need this?

kill -9 first is a common habit and it causes corrupt files, lost data and leftover locks.

What is it?

SIGTERM (15) asks the program to finish: save data, close connections, remove pid files. SIGKILL (9) is handled by the kernel: the process is removed at once, with no cleanup. Order: TERM, wait 10-30 s, then KILL only if needed. systemd does the same on stop (TimeoutStopSec).

How to do it (step by step)

1. Ask first, wait, then force.

kill 7710; for i in $(seq 10); do kill -0 7710 2>/dev/null || break; sleep 1; done; kill -0 7710 2>/dev/null && kill -9 7710

Output:

(no output)

What it means: Graceful stop with a 10 second limit.

2. What KILL looks like to the parent.

sleep 100 & kill -9 $!; wait $!; echo $?

Output:

[1]+  Killed    sleep 100
137

What it means: 137 = 128 + 9.

3. OOM killer uses SIGKILL too.

sudo journalctl -k | grep -i 'killed process' | tail -1

Output:

Out of memory: Killed process 8812 (python) total-vm:9.1G

What it means: Exit code 137 in Docker/K8s often means OOM.

5. SIGHUP: reload without restart

Why do we need this?

Many daemons re-read their config on SIGHUP, so you can apply changes with no downtime.

What is it?

For daemons (nginx, sshd, rsyslog, haproxy), SIGHUP means reload. For a normal terminal program it means 'your terminal closed' and it exits (that is why nohup exists). systemctl reload usually sends SIGHUP or runs ExecReload. Always test config first (nginx -t, sshd -t).

How to do it (step by step)

1. Test and reload nginx.

sudo nginx -t && sudo kill -HUP $(cat /run/nginx.pid)

Output:

nginx: configuration file /etc/nginx/nginx.conf test is successful

What it means: Workers restart gracefully; connections keep working.

2. The systemd way.

sudo systemctl reload sshd && systemctl status sshd --no-pager | grep -i reload

Output:

Oct 25 12:01:10 web1 systemd[1]: Reloaded OpenSSH server daemon.

What it means: Same effect, logged by systemd.

3. Tell rsyslog to reopen logs.

sudo pkill -HUP rsyslogd

Output:

(no output)

What it means: Used after manual log rotation.

6. SIGINT, SIGSTOP, SIGCONT and keyboard signals

Why do we need this?

Pause a heavy job for a few minutes during peak, then let it continue; or interrupt a script cleanly.

What is it?

Ctrl+C sends SIGINT, Ctrl+Z SIGTSTP, Ctrl+\ SIGQUIT to the foreground job. SIGSTOP pauses any process and cannot be caught. SIGCONT resumes it (bg/fg also send CONT). A stopped process shows T in ps.

How to do it (step by step)

1. Pause a backup.

sudo kill -STOP 9500 && ps -o pid,stat,cmd -p 9500

Output:

  PID STAT CMD
 9500 T    tar czf /backup/www.tgz /srv/www

What it means: T = stopped, using no CPU.

2. Resume it.

sudo kill -CONT 9500 && ps -o stat= -p 9500

Output:

R

What it means: Continues exactly where it was.

3. Interrupt from a script.

kill -INT 9810

Output:

(the program prints ^C-like cleanup)

What it means: Same as pressing Ctrl+C in its terminal.

7. pkill: signal by name or pattern

Why do we need this?

When there are many workers or you do not know PIDs, sending by name is faster.

What is it?

pkill uses the same matching as pgrep: NAME pattern, -f full command line, -u USER, -x exact, -t TTY, -n newest, -o oldest. Default signal TERM; -HUP, -9 etc. Always run pgrep -a with the same options first to see what would match.

How to do it (step by step)

1. Preview, then stop.

pgrep -af 'celery worker'; pkill -f 'celery worker'

Output:

5101 celery worker -A shop
5102 celery worker -A shop

What it means: Both workers get TERM.

2. All processes of a user.

sudo pkill -u intern1

Output:

(no output)

What it means: Ends a leaving user's sessions.

3. Kick a terminal session.

who; sudo pkill -KILL -t pts/3

Output:

guest pts/3 2026-10-25 11:40 (203.0.113.9)

What it means: Logs that user out.

4. Danger of loose patterns.

pgrep -l ssh

Output:

800 sshd
8700 sshd
9050 ssh-agent

What it means: pkill ssh would hit sshd too. Use -x.

8. killall: signal by exact program name

Why do we need this?

Stop every copy of one program with a clear exact-name match.

What is it?

killall NAME matches the exact process name (not a pattern). -s SIGNAL, -i asks for each, -u USER, -w waits until they die, -o/-y older/younger than a time. Installed by psmisc. On Solaris killall kills everything, so be careful on other Unix systems.

How to do it (step by step)

1. Stop all copies and wait.

killall -w php-fpm

Output:

(returns when all are gone)

What it means: -w is good in scripts before a restart.

2. Ask before each.

killall -i python3

Output:

Kill python3(8812) ? (y/N) y
Kill python3(8820) ? (y/N) n

What it means: Safe interactive use.

3. Old processes only.

killall -o 2h -u ravi sleep

Output:

(no output)

What it means: Kills ravi's sleeps older than 2 hours.

9. timeout: limit how long a command runs

Why do we need this?

A hanging curl, backup or test should not block a cron job or CI pipeline forever.

What is it?

timeout 30s CMD sends TERM after 30 seconds. -s KILL picks another signal. -k 5s sends KILL 5 s after the first signal if still alive. Exit code 124 means it timed out. Units: s, m, h, d.

How to do it (step by step)

1. Limit a health check.

timeout 5s curl -s https://api.example.com/health; echo $?

Output:

124

What it means: 124 = timed out; the API is slow.

2. TERM, then KILL.

timeout -k 10s 1h ./nightly-report.sh

Output:

(no output)

What it means: Up to 1 hour, then TERM, then KILL after 10 s.

3. In cron.

*/5 * * * * timeout 4m /usr/local/bin/sync.sh

Output:

(crontab line)

What it means: Next run never overlaps the last.

10. trap: handle signals in bash scripts

Why do we need this?

When a script is stopped (Ctrl+C, TERM from systemd), it should remove temp files and locks instead of leaving a mess.

What is it?

trap 'COMMANDS' SIGNALS runs COMMANDS when a signal arrives. EXIT runs on any exit, ERR on a failing command. trap '' INT ignores Ctrl+C. trap - INT restores default. trap -p shows current traps. KILL and STOP cannot be trapped.

How to do it (step by step)

1. Clean up temp files on exit.

cat clean.sh
#!/bin/bash
tmp=$(mktemp)
trap 'rm -f "$tmp"; echo cleaned' EXIT
echo working > "$tmp"; sleep 30

Output:

(press Ctrl+C)
^Ccleaned

What it means: Runs on normal end and on Ctrl+C.

2. Graceful stop on TERM.

trap 'echo stopping; kill $child; wait $child; exit 0' TERM; ./worker & child=$!; wait

Output:

(after kill -TERM of the script) stopping

What it means: Passes the stop to the child and waits.

3. Reload on HUP.

trap 'source /etc/myapp.conf; echo reloaded' HUP

Output:

(after kill -HUP) reloaded

What it means: Your script acts like a daemon.

4. Show active traps.

trap -p

Output:

trap -- 'rm -f "$tmp"; echo cleaned' EXIT

What it means: Useful while debugging.

11. Zombies and D-state: processes that will not die

Why do we need this?

kill -9 does not remove them, and people waste hours. You must know the real fix.

What is it?

A zombie (Z) has already exited; only its exit record waits for the parent. Fix the parent: send it SIGCHLD or restart it; if the parent dies, systemd adopts and reaps it. A D-state process is inside the kernel waiting for IO (dead NFS, failing disk); signals wait until IO returns. Fix the storage, use umount -f/-l for NFS, or reboot.

How to do it (step by step)

1. Find zombies and their parents.

ps -eo pid,ppid,stat,cmd | awk '$3 ~ /Z/'

Output:

 9901  9900 Z    [worker] <defunct>

What it means: PPID 9900 must reap it.

2. kill -9 on a zombie does nothing.

kill -9 9901; ps -o stat= -p 9901

Output:

Z

What it means: It is already dead.

3. Nudge or restart the parent.

kill -CHLD 9900; sleep 1; ps -o stat= -p 9901 || echo reaped

Output:

reaped

What it means: If not, restart the parent service.

4. D-state from a dead NFS.

ps -eo pid,stat,wchan:20,cmd | awk '$2 ~ /D/'

Output:

7001 D    nfs_wait_bit_killable ls /mnt/nfs

What it means: Waiting on NFS; fix the mount.

12. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

13. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

14. Troubleshooting step by step

Why do we need this?

If a process will not stop: identify it, try TERM, check its state, then KILL, and if it still stays, look at zombies or D-state.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Confirm the exact process.

pgrep -a myapp

2. Ask it to stop.

kill PID

3. Wait and check the state.

sleep 10; ps -o pid,stat,cmd -p PID

4. Force only if needed.

kill -9 PID

5. Zombie? Look at the parent.

ps -o ppid= -p PID

6. D-state? Check storage.

dmesg -T | tail -20

15. Lab 1: Graceful vs forced stop

Why do we need this?

Write a small script that cleans up on TERM, then compare TERM and KILL.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create the script.

cat > ~/svc.sh <<'X'
#!/bin/bash
touch /tmp/svc.lock
trap 'rm -f /tmp/svc.lock; echo clean exit; exit 0' TERM INT
while true; do sleep 1; done
X
chmod +x ~/svc.sh

Output:

(no output)

2. Run and stop with TERM.

~/svc.sh & sleep 1; kill $!; wait $!; echo code=$?; ls /tmp/svc.lock

Output:

clean exit
code=0
ls: cannot access '/tmp/svc.lock': No such file or directory

3. Run and stop with KILL.

~/svc.sh & sleep 1; kill -9 $!; wait $!; echo code=$?; ls /tmp/svc.lock

Output:

code=137
/tmp/svc.lock

4. See the difference.

echo 'KILL left the lock file behind'

Output:

KILL left the lock file behind

5. Clean up.

rm -f /tmp/svc.lock ~/svc.sh

Output:

(no output)

16. Lab 2: Pause, resume, reload and time-limit

Why do we need this?

Use STOP/CONT, pkill with preview, and timeout.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Start two workers.

(sleep 500 &) ; (sleep 501 &) ; pgrep -a sleep

Output:

9950 sleep 500
9951 sleep 501

2. Pause and resume one.

kill -STOP 9950; ps -o pid,stat -p 9950; kill -CONT 9950; ps -o stat= -p 9950

Output:

  PID STAT
 9950 T
S

3. Preview then pkill.

pgrep -af 'sleep 50'; pkill -f 'sleep 50'; pgrep -c sleep

Output:

9950 sleep 500
9951 sleep 501
0

4. Time-limit a command.

timeout 2s sleep 10; echo $?

Output:

124

5. Reload a daemon safely.

sudo sshd -t && sudo systemctl reload sshd && echo reloaded

Output:

reloaded

17. Frequently asked questions

18. Interview questions and answers

Beginner level

Mid level level

Senior level

19. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.