Managing processes with kill and killall

In Linux, every program and daemon is a “process.” Most processes represent a single running program. Other programs can fork off other processes, such as processes to listen for certain things to happen and then respond to them. And each process requires a certain amount of memory and processing power. The more processes you have running, the more memory and CPU cycles you’ll need. On older systems, like my 12-year-old laptop, or smaller computers like the Raspberry Pi, you can get the most out of your system if you keep an eye on what processes you have running in the background.

You can get a list of running processes with the ps command. You’ll usually want to give ps some options to show more information in its output. I like to use the -e option to see every process running on my system, and the -f option to get full details about each process. Here are some examples:

$ ps
    PID TTY          TIME CMD
  11289 pts/1    00:00:00 bash
  11292 pts/1    00:00:00 ps

Or, for more detail about every (-e) process:

$ ps -e | head
    PID TTY          TIME CMD
      1 ?        00:00:01 systemd
      2 ?        00:00:00 kthreadd
      3 ?        00:00:00 pool_workqueue_release
      4 ?        00:00:00 kworker/R-rcu_gp
      5 ?        00:00:00 kworker/R-sync_wq
      6 ?        00:00:00 kworker/R-slub_flushwq
      7 ?        00:00:00 kworker/R-netns
      9 ?        00:00:00 kworker/0:0H-events_highpri
     12 ?        00:00:00 kworker/R-mm_percpu_wq

And for full (-f) details:

$ ps -ef | head
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 09:46 ?        00:00:01 /usr/lib/systemd/systemd --switched-root --system --deserialize=40 rhgb
root           2       0  0 09:46 ?        00:00:00 [kthreadd]
root           3       2  0 09:46 ?        00:00:00 [pool_workqueue_release]
root           4       2  0 09:46 ?        00:00:00 [kworker/R-rcu_gp]
root           5       2  0 09:46 ?        00:00:00 [kworker/R-sync_wq]
root           6       2  0 09:46 ?        00:00:00 [kworker/R-slub_flushwq]
root           7       2  0 09:46 ?        00:00:00 [kworker/R-netns]
root           9       2  0 09:46 ?        00:00:00 [kworker/0:0H-events_highpri]
root          12       2  0 09:46 ?        00:00:00 [kworker/R-mm_percpu_wq]

The last example shows the most detail. On each line, the UID (user ID) shows the user that owns the process. The PID (process ID) represents the numerical ID of each process, and PPID (parent process ID) shows the ID of the process that spawned this one. In any Unix system, processes count up from PID 1, the first process to run once the kernel starts up. Here, systemd is the first process, which spawned kthreadd. And kthreadd created other processes including pool_workqueue_release and several “worker” processes.

Managing processes with kill

The system will take care of most background processes on its own, so you don’t need to worry about them. You should only have to get involved in managing any processes that you create, usually by running applications. While many applications run one process at a time (think about your music player or terminal emulator or game), other applications might create background processes. Some of these might keep running when you exit the application so they can get back to work quickly the next time you start the application.

Process management is an issue when I run the Chrome browser. Chrome works my laptop pretty hard and fires off a lot of extra processes. Right now, I can see these Chrome processes running with only a few tabs open:

$ ps -ef | grep chrome | wc -l
24

$ ps -ef | grep chrome | head
jhall       2471    1920  3 09:47 ?        00:08:03 /opt/google/chrome/chrome
jhall       2478       1  0 09:47 ?        00:00:00 /opt/google/chrome/chrome_crashpad_handler --monitor-self --monitor-self-annotation=ptype=crashpad-handler --database=/home/jhall/.config/google-chrome/Crash Reports --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=lsb-release=Fedora Linux 40 (Xfce) --annotation=plat=Linux --annotation=prod=Chrome_Linux --annotation=ver=131.0.6778.69 --initial-client-fd=5 --shared-client-connection
jhall       2480       1  0 09:47 ?        00:00:00 /opt/google/chrome/chrome_crashpad_handler --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=/home/jhall/.config/google-chrome/Crash Reports --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=lsb-release=Fedora Linux 40 (Xfce) --annotation=plat=Linux --annotation=prod=Chrome_Linux --annotation=ver=131.0.6778.69 --initial-client-fd=4 --shared-client-connection
jhall       2486    2471  0 09:47 ?        00:00:00 /opt/google/chrome/chrome --type=zygote --no-zygote-sandbox --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable
jhall       2487    2471  0 09:47 ?        00:00:00 /opt/google/chrome/chrome --type=zygote --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable
jhall       2489    2487  0 09:47 ?        00:00:00 /opt/google/chrome/chrome --type=zygote --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable
jhall       2514    2486  3 09:47 ?        00:07:06 /opt/google/chrome/chrome --type=gpu-process --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --shared-files --field-trial-handle=3,i,18298794817931529311,15571106924415392790,262144 --variations-seed-version=20241118-164138.616000
jhall       2517    2471  0 09:47 ?        00:02:00 /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18298794817931529311,15571106924415392790,262144 --variations-seed-version=20241118-164138.616000
jhall       2554    2489  0 09:47 ?        00:00:01 /opt/google/chrome/chrome --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18298794817931529311,15571106924415392790,262144 --variations-seed-version=20241118-164138.616000
jhall       2624    2489  1 09:47 ?        00:02:16 /opt/google/chrome/chrome --type=renderer --string-annotations --crashpad-handler-pid=2478 --enable-crash-reporter=, --change-stack-guard-on-fork=enable --lang=en-US --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1732031201381244 --launch-time-ticks=47432658 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18298794817931529311,15571106924415392790,262144 --variations-seed-version=20241118-164138.616000

By default, Chrome will also keep these processes running after you exit the application. You can see this for yourself in the Chrome setting for “Continue running background apps when Google Chrome is closed” (under “System”). You might turn off this feature, or Chrome processes will keep running when you close the application, and continue to use memory. This extra usage use isn’t usually a problem on systems that have a fast CPU and are stuffed with memory, like my desktop PC. But my older laptop has limited memory, yet I use it all the time to do presentations. I don’t want to keep these extra processes running after I exit the browser. If I forget to change this setting, my older laptop suffers even after I quit Chrome.

Fortunately, you can use the command line to stop these processes after you exit Chrome. The kill command lets you terminate a process. In the simplest case, you tell kill the PID of what you want to stop. For example, to terminate each of these processes, I would need to execute the kill command against each of the process IDs. One way to do that is with a command line that gets the PIDs and another that runs kill against that list:

$ ps -ef | grep '/opt/google/chrome/chrome' | awk '{print $2}'
2471
2478
2480
2486
2487
2489
2514
2517
2554
2624
2646
2656
2699
2721
4582
4685
4697
8945
9512
9521
11022
11240
11439
11660

And:

$ ps -ef | grep '/opt/google/chrome/chrome' | awk '{print $2}' > pids
$ kill $(cat pids)

The first command line generates a list of process IDs for the Chrome browser. The second command line runs the kill command against that list of process IDs.

The killall command

A simpler way to stop a bunch of processes all at once is to use the killall command. As you might guess by the name, killall terminates all processes that match a name. That means we can use this command to stop all of our rogue Chrome processes. This is as simple as:

$ killall /opt/google/chrome/chrome

But be careful with killall. This command can terminate any process that matches what you give it. That’s why I like to first use ps -ef to check my running processes, then run killall against the exact path to the command that I want to stop.

You might also want to use the -i or –interactive option to ask killall to prompt you before it stops each process.

killall also supports options to select processes that are older than a specific time using the -o or –older-than option. This can be helpful if you discover a set of rogue processes that have been running unattended for several days, for example. Or you can select processes that are younger than a specific time, such as runaway processes you recently started. Use the -y or –younger-than option to select these processes.

Process management can be an important part of system maintenance. In my early career as a Unix and Linux systems administrator, the ability to end escaped jobs was a useful tool to keep systems running properly. You may not need to stop rogue processes in a modern Linux desktop, but knowing kill and killall can help you when things eventually go awry. It’s always a good idea to keep an eye on what processes are running on your system and know how to manage them when needed.

This article is adapted from Managing processes on Linux with kill and killall by Jim Hall, and is republished with the author’s permission.