Kill a Process on Linux: ps, kill, pkill and Signals

A runaway script eating CPU, a frozen app or a port held by a forgotten process: sometimes you need to stop a process by hand. Knowing how to kill a process on Linux properly, gracefully first, avoids corrupting data. This guide covers finding processes and stopping them safely.

Before you start

SSH access. You can signal your own processes; root can signal any.
If the process belongs to a service, prefer systemctl stop or restart; systemd may otherwise restart it immediately.

Find the process

All processes with full details:

ps aux

Search by name (the bracket trick hides the grep itself):

ps aux | grep '[p]hp-fpm'

Just the PIDs:

pgrep -a node

Top CPU or memory users:

ps aux --sort=-%cpu | head

ps aux --sort=-%mem | head

As a tree, to see parent and child processes:

ps -ef --forest | less

Which process uses a port: ss -ltnp 'sport = :3000'.

Understand signals

Signal	Number	Effect
SIGTERM	15	Polite request to stop; the program can clean up. Default for kill.
SIGINT	2	Same as pressing Ctrl+C
SIGHUP	1	Many daemons reload their config on it
SIGKILL	9	Immediate stop by the kernel; no cleanup possible
SIGSTOP / SIGCONT	19 / 18	Pause / resume

Stop a process gracefully

kill 12345

Wait a few seconds and check whether it is gone: ps -p 12345. Only if it ignores SIGTERM, force it:

kill -9 12345

Warning: avoid kill -9 on databases such as MySQL or PostgreSQL. A forced stop skips clean shutdown and can trigger long crash recovery. Use systemctl stop instead.

Stop processes by name

pkill -f 'node server.js': matches against the full command line.
pkill -u alice: all processes of a user.
killall php: all processes with that exact name.

Check what would match before killing: pgrep -af 'node server.js'.

Lower priority instead of killing

A heavy but legitimate job can keep running at lower priority:

renice +10 -p 12345

Start jobs politely in the first place with nice -n 10 command and ionice -c3 command for disk-heavy work.

Zombie and stuck processes

Zombies (state Z in ps) have already exited; they use no resources and cannot be killed. They disappear when the parent collects them. If many pile up, restart the parent process (ps -o ppid= -p ZOMBIE_PID shows it).
D state (uninterruptible sleep) means the process waits on disk or network I/O. Even kill -9 takes effect only when the I/O returns. Look for storage or NFS problems.

Run commands that survive logout

Processes started in your SSH session stop when it closes. For long tasks use tmux or screen, or nohup command &. For permanent apps, create a systemd service or use a process manager such as PM2.

Troubleshooting

Operation not permitted: the process belongs to another user. Use sudo.
Process comes back after kill: systemd, PM2, supervisord or cron restarts it. Stop it through that manager.
No such process: it already exited, or the PID changed. Look it up again.

Linux processes FAQ

What is the difference between kill and kill -9?

kill sends SIGTERM, letting the program shut down cleanly. kill -9 sends SIGKILL, which the kernel enforces instantly with no cleanup.

How do I see processes interactively?

Use htop: select a process and press F9 to send a signal.

Can I kill processes on cPanel hosting?

Only your own, via SSH or cPanel → Metrics → Resource Usage; CloudLinux also limits each account so one runaway script cannot affect others.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket