74

I am familiar with kill command , and most of the time we just use kill -9 to kill a process forcefully, there are many other signals that can be used with kill. But I wonder what are the use cases of pkill and killall, if there is already a kill command.

Do pkill and killall use the kill command in their implementation? I mean they are just wrappers over kill or they have their own implementation?

I would also like to know how pgrep command gets the process id from the process name.

Do all these commands use the same underlying system calls? Is there any difference from a performance point of view, which one is faster?

Improve this question
2
  • 7
    Two things: Why use kill -9 by default? -15 (please stop) and -1 (modem has hung up, please CLEANLY closed yourself) are much more polite. Secondly. Beware of using killall on non-linux boxes. It might behave differently. (E.g. on solaris it kills all. NOT FILTERED on process names). Commented Dec 30, 2015 at 16:49
  • 4
    Related: unix.stackexchange.com/questions/91527/… Commented Jun 25, 2019 at 9:28

4 Answers 4

Reset to default
69

The kill command is a very simple wrapper to the kill system call, which knows only about process IDs (PIDs). pkill and killall are also wrappers to the kill system call, (actually, to the libc library which directly invokes the system call), but can determine the PIDs for you, based on things like, process name, owner of the process, session id, etc.

How pkill and killall work can be seen using ltrace or strace on them. On Linux, they both read through the /proc filesystem, and for each pid (directory) found, traverses the path in a way to identify a process by its name or other attributes. How this is done is technically speaking, kernel and system specific. In general, they read from /proc/<PID>/stat which contains the command name as the 2nd field. For pkill -f and pgrep examine the /cmdline entry for each PID's proc entry.

pkill and pgrep use the readproc system call, whereas killall does not. I couldn't say if there's a performance difference: you'll have to benchmark that on your own.

Improve this answer
1
  • readproc is not a system call. It's a libprocps library function. Commented Sep 19, 2020 at 14:33
12

A more practical answer:

  • kill will send a SIGTERM (terminate a process) signal to the OS for a given process id (e.g. 10341), by default this is SIGTERM. You can actually specify other signals too (e.g. -9 to force terminate)

  • killall will send SIGTERM to all processes matching a certain name exactly. It also comes wit other goodies such as subsetting by user.

  • pkill will send SIGTERM to all processes that match a given pattern. It uses pgrep under the hood.

Improve this answer
4
  • 1
    The answer is a good TLDR summary, but SIGTERM is not a system call but a signal. Commented Sep 16, 2022 at 12:45
  • 1
    killall doesn't just kill names that match exactly. For example killall foo will also kill a process named foo_bar. Commented Jan 31, 2024 at 3:26
  • @friederbluemle I've just tested this on an Ubuntu box, and killall testbed didn't kill a process called testbed_loop. Commented Jun 20, 2024 at 10:42
  • 1
    @friederbluemle Was that comment inspired by something involving a process with a name longer than 15 characters? According to the manpage, killall's default behaviour for these is "killall will kill everything that matches within the first 15 characters." Commented Jun 20, 2024 at 11:00
4

kill and killall are tools which provide a way to kill a process. The first by its PID, the second by its name. pgrep (list) and pkill (kill by default) are tools which provide a way to send message to a process by its name or other attributes see: http://linux.die.net/man/1/pkill For more info about signals: http://linux.die.net/man/7/signal

Improve this answer
3
  • Do you mean killall is used to kill a process by its name? and it uses pgrep for this purpose? and killall also kills all the child processes ,? what signal killall uses by default? Commented Dec 30, 2015 at 16:23
  • 3
    ...unless you're on Solaris, in which case killall will kill all processes you have the right to kill, so that if you're root, you're effectively rebooting the server. Commented Dec 30, 2015 at 16:25
  • 1
    yep: killall chromium will kill the chromium process, pgrep chromium will give you the PID list, pkill chromium will kill chromium. killall will send by default SIGTERM signal (as pkill) Commented Dec 30, 2015 at 16:28
0

macOS man pages have an interesting section:

IMPLEMENTATION NOTES

This FreeBSD implementation of killall has completely different semantics as compared to the traditional UNIX System V behavior of killall. The latter will kill all processes that the current user is able to kill, and is intended to be used by the system shutdown process only.

Improve this answer
1
  • 1
    Before using killall on a unfamiliar Unix system, you should first check which version of the command it has: the BSD version will send signals to processes matching a specified string, but the SysV version will indeed kill all the processes it possibly can. Long ago, on my first Sun Solaris sysadmin job, the latter behavior caused me an embarrassing moment... well, at least after that I had solid proof that the NIS failover worked in that environment! Commented Oct 19, 2024 at 8:09

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.