Why does a process remain after kill -9?

A process stuck in an uninterruptible kernel wait, often shown as D state, may not disappear until the underlying kernel or I/O condition changes.

How to Kill a Process in Linux: ps, kill, pkill & killall

Q: How do I kill a process in Linux?

First identify and verify the process PID, then send SIGTERM with kill PID. Verify the process stopped before escalating.

Q: What is the difference between kill and kill -9?

kill PID normally sends SIGTERM, which allows an application to shut down cleanly. kill -9 sends SIGKILL, which cannot be caught or handled by the process.

Q: How do I kill a process by name?

Use pgrep to identify matching processes, then pkill or killall when targeting processes by name is appropriate.

Q: How do I find which process is using a port?

Use ss or lsof, such as sudo ss -ltnp 'sport = :8080' or sudo lsof -i :8080.

!Issue

Applications may become unresponsive, consume excessive resources or continue running after their terminal has closed.

✓Solution

Identify and verify the PID, send SIGTERM first, check the result and escalate to SIGKILL only when appropriate.

★Recommendations

Target the smallest possible scope and use systemctl for services managed by systemd.

TechRunbook approach: Find the process, verify the PID and command, try graceful termination, then investigate or escalate only when necessary.

What Is a Linux Process?

A process is a running instance of a program. Linux assigns every process a process ID, commonly called a PID.

ps

Example:

PID TTY          TIME CMD
2418 pts/0    00:00:00 bash
3152 pts/0    00:00:01 python3

Find Processes With ps

ps aux

Search for a process:

ps aux | grep nginx

For cleaner process-name searches:

pgrep -a nginx

Find a Process With pgrep

pgrep nginx

Display PID and command:

pgrep -a nginx

Example:

1234 nginx: master process nginx
1287 nginx: worker process

Verify the PID Before Killing

ps -p 3152 -f

Confirm the command, user and parent process before sending a signal.

Important:

PIDs can be reused. Do not blindly kill a PID copied from an old command, log or screenshot.

Understand Linux Signals

Signal	Number	Purpose
`SIGTERM`	15	Request graceful termination
`SIGKILL`	9	Force termination
`SIGHUP`	1	Hangup/reload behavior depending on application
`SIGINT`	2	Interrupt
`SIGSTOP`	19	Stop/suspend process
`SIGCONT`	18	Continue stopped process

Kill a Process With kill

Graceful termination

kill 3152

By default, this sends SIGTERM.

Explicit SIGTERM

kill -TERM 3152

or:

kill -15 3152

Verify That the Process Stopped

ps -p 3152

A practical workflow is:

kill 3152
sleep 2
ps -p 3152

If it remains, investigate before escalating.

Use SIGKILL Only When Necessary

kill -KILL 3152

or:

kill -9 3152

Escalation warning:

SIGKILL cannot be caught or handled by the application, so normal shutdown and cleanup handlers do not get an opportunity to run.

Why kill -9 Should Not Be the Default

Forceful termination can prevent an application from:

Closing files cleanly
Finishing transactions
Writing final log information
Running shutdown handlers
Cleaning up application-level resources

Use SIGTERM first whenever practical.

Kill Processes by Name With pkill

pkill -TERM firefox

Because multiple processes may match, inspect first:

pgrep -a firefox

Use pkill Carefully

Avoid broad commands such as:

pkill -9 python

A host may have multiple Python applications.

Inspect first:

pgrep -a python

Then target the intended PID where practical.

Kill Processes With killall

killall -TERM firefox

As with pkill, understand which processes will match before using the command on shared or production systems.

Compare kill, pkill and killall

Command	Target	Typical Use
`kill PID`	Specific PID	Targeted termination
`pkill name`	Matching processes	Process-name/criteria matching
`killall name`	Processes by name	Matching process names
`kill -9 PID`	Specific PID	Last-resort termination

Find High-CPU Processes

top

Or:

htop

You can also use:

ps aux --sort=-%cpu | head

High CPU usage is a symptom, not automatically a reason to terminate a process. Investigate what the application is doing first.

Find High-Memory Processes

ps aux --sort=-%mem | head

Inspect a specific process:

ps -p 3152 -o pid,ppid,user,%cpu,%mem,etime,cmd

Understand Parent and Child Processes

ps -ef

A process may have children or be managed by another process. You can also inspect the tree:

pstree -p

Understanding the relationship can help avoid terminating the wrong component.

Check Process Ownership

ps -p 3152 -o pid,user,group,cmd

If the process belongs to root or a production service account, verify its purpose before terminating it.

Kill a Process Owned by Another User

ps -p 3152 -f

If elevated privileges are legitimately required:

sudo kill 3152

Verify the target before using elevated privileges.

Stop a Foreground Process With Ctrl+C

For a command running in your current terminal, try:

Ctrl+C

For example:

ping example.com

Pressing Ctrl+C normally interrupts the foreground command.

Suspend a Process With Ctrl+Z

Ctrl+Z

Check shell jobs:

jobs

Resume in foreground:

fg %1

Resume in background:

bg %1

Kill a Shell Job

jobs

Example:

[1]+  Running  python3 app.py &

Terminate:

kill %1

Here %1 is the shell job number, not the PID.

Find a Process Using a Port

sudo ss -ltnp 'sport = :8080'

Or:

sudo lsof -i :8080

Example:

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
python3 3152 app     3u  IPv4 ...          TCP *:8080 (LISTEN)

Safely Stop a Process Listening on Port 8080

sudo ss -ltnp 'sport = :8080'

Identify the PID and verify it:

ps -p 3152 -f

If confirmed:

sudo kill 3152

Verify the port:

sudo ss -ltnp 'sport = :8080'

Only escalate to sudo kill -9 3152 when appropriate.

When a Process Does Not Die After kill -9

A process can remain visible if it is stuck in an uninterruptible kernel wait, commonly shown as D state.

ps -p PID -o pid,stat,wchan,cmd

Investigate possible storage, network filesystem, device or kernel I/O problems.

Zombie Processes

ps -eo pid,ppid,stat,cmd | awk '$3 ~ /^Z/ {print}'

A zombie has already exited but remains in the process table until its parent collects its exit status.

Investigate the parent:

ps -p PARENT_PID -f

Sending SIGKILL to the zombie itself does not make the completed process run again.

Use systemctl for systemd Services

If a process is managed by systemd, use the service manager when possible.

systemctl status nginx

Stop:

sudo systemctl stop nginx

Restart:

sudo systemctl restart nginx

Killing the underlying process may only provide a temporary result if the service manager restarts it.

Practical Example: Stuck Python Process

Scenario
A Python application appears stuck and is consuming excessive CPU.

Find it:

pgrep -a -f 'python3 app.py'

Inspect it:

ps -p 3152 -o pid,ppid,user,%cpu,%mem,etime,cmd

Send SIGTERM:

kill 3152

Wait briefly:

sleep 2

Verify:

ps -p 3152

If it remains and force termination is justified:

kill -9 3152

Process Termination Troubleshooting Path

Process problem
      ↓
Find process
      ↓
Verify PID + command + user
      ↓
Send SIGTERM
      ↓
Check process
   ↙       ↘
Gone     Still running
 ↓             ↓
Done       Investigate
              ↓
       Escalate if justified
              ↓
          SIGKILL
              ↓
            Verify

Process Management Cheat Sheet

# Show processes
ps aux

# Find a process
pgrep -a nginx

# Inspect a PID
ps -p 1234 -f

# Graceful termination
kill 1234

# Explicit SIGTERM
kill -TERM 1234

# Force termination
kill -KILL 1234

# CPU-heavy processes
ps aux --sort=-%cpu | head

# Memory-heavy processes
ps aux --sort=-%mem | head

# Interactive monitoring
top

# Find process using a port
sudo lsof -i :8080

# Inspect listening port
sudo ss -ltnp 'sport = :8080'

# Process tree
pstree -p

# Service status
systemctl status service-name

Frequently Asked Questions

How do I kill a process in Linux?

First identify and verify the PID, then use kill PID. Verify that the process stopped before escalating.

What is the difference between kill and kill -9?

kill PID normally sends SIGTERM, while kill -9 PID sends SIGKILL. SIGTERM allows an application to handle shutdown; SIGKILL cannot be handled.

How do I kill a process by name?

Use pgrep -a process-name to inspect matching processes first, then use pkill or killall when appropriate.

Why is a process still running after kill?

The process may need time to shut down, may be handling SIGTERM or may be stuck. Inspect its state with ps.

Why does kill -9 sometimes not work?

A process in an uninterruptible kernel wait, commonly shown as D state, may remain until the underlying I/O or kernel condition changes.

How do I find which process is using a port?

Use sudo ss -ltnp 'sport = :8080' or sudo lsof -i :8080.

Related TechRunbook Guides

Was this guide helpful?

How to Kill a Process in Linux: ps, kill, pkill & killall

What Is a Linux Process?

Find Processes With ps

Find a Process With pgrep

Verify the PID Before Killing

Understand Linux Signals

Kill a Process With kill

Graceful termination

Explicit SIGTERM

Verify That the Process Stopped

Use SIGKILL Only When Necessary

Why kill -9 Should Not Be the Default

Kill Processes by Name With pkill

Use pkill Carefully

Kill Processes With killall

Compare kill, pkill and killall

Find High-CPU Processes

Find High-Memory Processes

Understand Parent and Child Processes

Check Process Ownership

Kill a Process Owned by Another User

Stop a Foreground Process With Ctrl+C

Suspend a Process With Ctrl+Z

Kill a Shell Job

Find a Process Using a Port

Safely Stop a Process Listening on Port 8080

When a Process Does Not Die After kill -9

Zombie Processes

Use systemctl for systemd Services

Practical Example: Stuck Python Process

Process Termination Troubleshooting Path

Process Management Cheat Sheet

Frequently Asked Questions

Related TechRunbook Guides

References