There are times when “kill -9″ is the only time you can kill a PID that is behaving badly. However, it’s usually not needed if you know your signals. When I encounter a badly behaving program, here is the procedure I usually take.
First, I’ll send a SIGTERM (kill -15) to the PID. Sometimes this works, sometimes this doesn’t. However, SIGTERM is a clean shutdown of the program. It will flush any data to disk that needs to be written, clean up the memory registers, and close the PID.
If that doesn’t work, then I will send a SIGHUP (kill -1). This will generally cause the program to restart. Restarting the program will flush any data to disk that needs to be written, and cleans up the memory registers, then restarts the program.
If that doesn’t work, then I will send a SIGINT (kill -2). This is an interrupt from the keyboard signal. This is equivalent to sending a CTRL-C to the PID. This is useful when the PID is not in the terminal foreground, but has been backgrounded as a daemon process.
If that doesn’t work, then I will send a SIGSEGV (kill -11). This causes the program to experience a segmentation fault, and close the PID. It won’t flush any data that needs to be written to disk, but it may create a core dump file that could be useful in debugging, on learning why the program was behaving the way it was. The logging facility for that core dump is through the kernel.
At this point, if none of the above signals have worked, only then will I issue a SIGKILL (kill -9). However, using this signal is potentially dangerous, as it is equivalent to ripping its feet out from under it. It will not sync any data, at all, to disk. No unwritten data, no debugging data, no logging data, no nothing. It’s equivalent to using a sledge hammer to sink a nail.
Further, at this point, if I haven’t been able to clean up the PID with the previous commands, then a SIGKILL usually won’t clean up the PID either. Using SIGTERM, SIGHUP, SIGINT and SIGSEGV usually clean up 80% of the PIDs I wish to clean. When I need to issue SIGKILL, I’m met with maybe 50% success.

{ 8 } Comments
Wow !!! This is really very helpful information. I always used to use kill -9 but now onwards will be using your suggestions
Thanks for the info.
Wow thanks for the blog post. I’ve been using Linux for quite some years now and also had to deal with misbehaving processes once in a while. I usually try to send a SIGTERM to the processes before trying a SIGKILL. But I didn’t know or use the other possible signals not knowing their effect. Thank you for clearing that up.
Frankly (and I don’t blame you) I think for the average joe thats way too much effort, now if there was a program perhaps esckill (esculating kill) that did all that for me on supply of a PID I’d happily do it, but other than that I’ll stikc -9 as it works for me, and I’ve yet to encounter any problems with corruption afterwards.
KILL DASH NINE!
http://www.youtube.com/watch?v=Fow7iUaKrq4
Why SIGSEGV instead of SIGQUIT? Its default action is to dump core and it’s bound to Ctrl-\
Great post, thank you! I’ve used kill -9 for ages and never thought it might be a problem.
Thanx, this article cleared it a lot for me !
I have made a script to automate what you taught us.
Here it is at pastebin: http://pastebin.com/SCcK6dm5
Thank you!
Post a Comment