Episode 21 – killall

The previous two shows have discussed different ways to kill a process using kill and pkill. This episode will cover a third command, killall. The killall command is used to send a signal to every process that is running the identified command. For instance:

killall xterm

Will send the SIGTERM process to all incidents of xterm. Should there be any xterm processes running they would receive the default SIGTERM signal (recall, number 15) and be terminated. If there were no xterm processes running then killall would report the following:

xterm: no process found

This output can be suppressed using the -q, or –quiet, switch.

It should be noted that as the root user the killall command can be very powerful and terminate the processes of multiple users. The killall command will send a signal to all instances of the identified process regardless the user running them. As a normal user with non-elevated privileges the signal would be prevented from being sent to command that user does not have control. But run with elevated or root privileges killall will send the signal to all processes identified for all users running that process on the system. Be very careful with this level of power.

Conversely, you can request killall to be more verbose with the -v, or –verbose, switch. This will report the signal sent to the process. For instance:

killall -v xterm

May return:

Killed xterm(1980) with signal 15

As with the other kill commands you can specify a signal other than the default SIGTERM in the following ways:

  • killall -9
  • killall -KILL
  • killall -SIGKILL
  • killall -s 9
  • killall -s KILL
  • killall -s SIGKILL

These six commands all do the same thing, send the process the SIGKILL signal. To get a full list of the signals that can be sent issues:

killall -l

The -l works similar to kill -l but it only provides the main signal name sans the prefix: “SIG” and the signal number. Again, like kill and pkill the -s, or –signal, allows you to specify a signal other than SIGTERM to be sent to the process(es).

The killall command will accept more than one command name to be killed:

killall xterm aterm gvim

This example would send the SIGTERM signal to any processes run by the command xterm, aterm or gvim.

Command names can be passed using regular expressions with the -r, or –reg-exp switch. For instance:

killall -r term

Would kill any process with the word “term” in the command name. That would include: aterm, Eterm, xterm, gnome-terminal. Similarly:

killall -r \*term

Would do the same thing. (Note that most regular expressions symbols may require escaping, that is using the backslash: \). On the other hand, the following syntax:

killall -r [a,x]term

Would only kill aterm and xterm and would ignore Eterm and gnome-terminal.

Like most commands or Linux in general, killall is case sensitive. Therefore passing:

killall eterm

Would not send the SIGTERM signal to the Eterm process because the command begins with an uppercase “E”. Killall can work in a case insensitive mode with the -I, or –ignore-case, switch:

killall -I eterm

This would send the SIGTERM signal to all the Eterm processes running.

The killall command has a 15 character command limitation that can produce unintended results. If the process you want to kill has a command that is greater than 15 characters, killall only matches on the first 15 characters. The -e, or –exact, switch is used to prevent this from happening. The –exact switch tells killall that the command name must match and given the situation where there is greater than 15 characters, not to send the signal to any process in that situation.

All processes owned by a specific user can be sent a signal with the -u, or –user, switch:

killall -u dann

This would send the SIGTERM signal to all processes owned by the user dann. Unlike the kill or pkill you can only specify the user name it will not accept the user id.

Processes within the same process group can be killed with the -g, or –process-group, switch but be very careful with this switch as it works a bit differently than the user switch. The process group ID is not passed when using this command but instead the process name is used and any process groups associated with that command will be killed. For instance, if there were two users on the system running xterm: dann with xterm running under process group id 2752 and paige with xterm running under process group 3082; issuing the either of the following:

killall -g 2752
killall -g 3082

Would not work as one would expect. That is, it would not send the SIGTERM signal to the process group id 2752 or 3082. Instead the command would be issued as such:

killall -g xterm

Notice the danger of this command as it would send the SIGTERM signal to all the process group id’s the xterm command is under. That means those process running under the 2752 and 3082 process group IDs would be terminated. If the command was run as dann then dann would not have permission to kill any of paige’s processes. But if the command is run as root, then both dann’s and paige’s processes would be terminated. Be very careful with this syntax as you can easily destroy the session of another user inadvertently instead of just terminated a single process name.

There are two time options you can pass to killall: -o, or –older-than; and -y, or –younger-than. The -o switch will send a signal to the processes identified that were started before the specified time stamp. The -y will send the signal to processes identified that were started after the specified time stamp. The way you specify the time stamp is by a number-identifier format, where the identifier is one of the following:

  • s – seconds
  • m – minutes
  • h – hours
  • d – day of the month
  • w – week number
  • M – month number
  • y – year

For instance, to kill all xterm processes started after December 31, 2012 at 11:30 A.M.:

killall -y 11h30m12M31d2012y xterm

The killall command has an interactive mode: -i, or –interactive that will prompt the user for confirmation before killing any processes:

killall -i xterm

Will produce the following output before sending xterm the specified signal:

Kill xterm(3441) ? (y/N)

No is the default so lack of choice results in the process not receiving the signal.

The killall command has a wait option, -w, or –wait, that waits for all processes to die before returning to the prompt. This switch can cause killall to hand indefinitely should the process not accept the signal, so you may have to kill killall manually.

Finally, killall can work in conjunction with SELinux and kill processes in a given security context with the -Z, or –context switch. As per the man page this switch must proceed any other switches and will take extended regular expressions as input.

The killall command is similar to the pkill command in that it allows you to send signals to a group of processes given the command name.

blibliography

  • man killall
  • info killall

If the video is not clear enough view it off the YouTube website and select size 2 or full screen.  Or download the video in Ogg Theora format:

Thank you very much!

  • Ogg file hosted by Hacker Public Radio
  • Speex file hosted by Hacker Public Radio
  • Mp3 file hosted by Hacker Public Radio

AUDIO FILES ARE DELAYED, they should be posted on HPR soon, sorry for the wait!

 

 

This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>