Signals and kill: SIGTERM vs SIGKILL Explained

When you “kill” a process on Linux, you’re actually sending it a signal — a small message asking the process to do something. Signals are how Linux gracefully shuts down servers, reloads configs, or forcibly stops misbehaving programs. Knowing which signal to send matters: SIGKILL kills instantly, no cleanup; SIGTERM lets the process finish writing files first.

The signals you’ll actually use

Signal	Number	What it asks
SIGTERM	15	Please exit gracefully (default for kill)
SIGKILL	9	Die immediately (cannot be caught)
SIGINT	2	Interrupt (what Ctrl+C sends)
SIGHUP	1	Hangup; servers often reload config on this
SIGSTOP	19	Pause (cannot be caught)
SIGCONT	18	Resume after SIGSTOP
SIGTSTP	20	Suspend (what Ctrl+Z sends)
SIGUSR1/2	10/12	User-defined; apps decide what to do

SIGTERM vs SIGKILL — the most important distinction

SIGTERM (15)

“Please shut down.” The process can:

• Catch the signal and run a cleanup handler.
• Flush buffers to disk, close database connections, finish in-flight requests.
• Then exit cleanly.

This is what systemctl stop, Docker, and most well-behaved tools send. Always try SIGTERM first.

SIGKILL (9)

“Die now.” The kernel kills the process immediately. The process gets NO chance to:

• Save state.
• Close files (open files might be left in inconsistent state).
• Write logs.

Use SIGKILL only when SIGTERM doesn’t work after waiting a few seconds.

Sending signals: the kill command

kill 1234                      # send SIGTERM (default)
kill -TERM 1234                # explicit SIGTERM
kill -15 1234                  # same, by number
kill -KILL 1234                # SIGKILL — only if SIGTERM didn't work
kill -9 1234                   # same, by number
kill -HUP 1234                 # ask process to reload config

# Send signal to multiple PIDs
kill 1234 5678 9012

# Show all signal names
kill -l

Kill by name: pkill / killall

pkill nginx                # SIGTERM to all nginx processes
pkill -9 firefox           # SIGKILL all firefox
pkill -HUP nginx           # tell nginx to reload config
pkill -u alice             # kill all of alice's processes
killall -9 chrome          # similar to pkill

Practical workflow: graceful then forceful

# Try gracefully first
kill 1234
sleep 5

# Check if it's still running
if ps -p 1234 > /dev/null; then
    echo "still alive, forcing"
    kill -9 1234
fi

Reload config without restart (SIGHUP)

Many servers re-read their config when sent SIGHUP — no full restart, no dropped connections.

# Reload nginx config
sudo nginx -s reload          # nginx's own command
# or, equivalently
sudo kill -HUP $(cat /var/run/nginx.pid)

# Reload Postfix
sudo systemctl reload postfix

# Tell rsyslog to reopen log files (after rotation)
sudo kill -HUP $(pidof rsyslogd)

Pause and resume a process

kill -STOP 1234        # pause it (process is frozen)
kill -CONT 1234        # resume it

Useful when a runaway process is hammering disk or CPU but you want to inspect it before killing.

What Ctrl+C and Ctrl+Z actually do

• Ctrl+C sends SIGINT to the foreground process. Most programs exit cleanly on this.
• Ctrl+Z sends SIGTSTP — pauses the process. Resume with fg or bg.
• Ctrl+ sends SIGQUIT — like Ctrl+C but also dumps core. Rarely used.

Common mistakes

• Reaching for SIGKILL first. If a database is mid-write when you SIGKILL it, you can corrupt data. Always TERM first, KILL only if it ignores TERM.
• Killing parent processes. Some parents auto-restart their children (systemd, supervisord). Find the actual top of the chain with pstree.
• SIGKILL on a stuck-in-D-state process. Processes in uninterruptible sleep (D state, often disk I/O) cannot be killed by ANY signal until the kernel completes the operation.

What to learn next

Now that processes are under control, the next big topic is systemd — the service manager that starts, stops, and supervises all the long-running processes on your system.