When Linux Goes Rogue – Killing Processes

Although Linux has a reputation for rock solid stability, sometimes applications hang, or go bad, and either your linxu box is, or at least appears dead. When you find yourself with a hung application, or a hung box, what are your options for regaining control, or at least effecting a (somewhat) graceful shutdown to prevent potential filesystem corruption. This howto sets out your options when find yourself “all hung up”.

hung applications

When an application hangs, and your cpu is being eaten to death, you need to kill it quick. So what are your options?


This is a cool little application that is used to kill gui applications. When you start xkill, your cursor should turn into a skull and crossbones, then any application you left click on should be killed. In kde, you can start xkill with the ctrl+alt+escape key combination. If you run beryl, it (seems) to ignore kde’s built in key combinations, so you need to set up the key combination yourself. Open the beryl settins-manager. Under the General Options section, ther will be a commands tab. This is the place where you can set commands that will run when the corresponding key combinations is pressed. So under Command0 enter xkill. Then under the same General Options section, click on the Shortcuts icon on the left. Under Keyboard and Mouse tab, expand the General Options tree item, and then the Commands subtree. You should then get a list of Commands. Highlight Command0, and then change the keyboard shortcut to <Control><Alt>Escape. xkill should then work when you press the key combo in beryl.

command line

If you want to kill an application from the command line, then you can use the kill, or killall command. The kill command requires you to know the process number. You can find this with the ps aux command, or more simply, use the kill command in conjunction with the pidof command like this:

kill `pidof kmail`

This will kill kmail. Notice that the ` symbols used are back ticks – these can usually be found on the tilda(~) key on your keyboard. This feeds the result of the pidof command to kill. The kill command allows you to specify whether the application is killed “mercifully”, or “in cold blood”. Using the kill command stops the process,but gives the killed process the change to clean up. However, sometimes kill alone isn’t enough, sometimes you need to really kill an application. To do this, use:

kill -9 `pidof kmail`

This should kill the application, but does not give the process the chance to clean up, so may result in zombie child processes. However, if a process is eating all your cpu, you may not be that worried about the odd zombie floating around.

Even easier is the killall command. This will work on applications by name, rather than by process number. So to kill kmail, you would type:

killall kmail

Much simpler.

a hung box

Very rarely, the whole box might hang, or at least appear to be hung. It is very rare that the linux kernel crashes. So when your box hangs, it is more likely that it is not a crash, but a process that is waiting for a resource to come free. However, it still looks like a crash to a user. When this happens, there are a couple of things you can try before you hit the power button. First, you could just try waiting – wait for the process to right itself.

killing x

If the gui’s hung, then you can try simply killing X and starting the gui again. The key combination to just kill X is ctrl+alt+backspace. This will kill X and either put you back to a text terminal, or if you’ve got a display manager running like kdm or gdm, spawn a new display manager session.

remote kill

If you have another box on the same network, you could try ssh’ing into the hung box. This of course means that you need to have ssh running on the hung box in the first place. However, often times when the keyboard and mouse are useless, you can often still access the box over ssh. For more information on ssh and passwordless ssh logins, have a look at this article. Once you’ve ssh’d into the hung box, you can kill whatever process is hung (see above), and hopefully carry on.

a little bit of magic

However, if you can’t ssh into the box, you may still be able to close down gracefully. If you’ve got the “magic SysRq” keys enabled, then you should be able to shut things down without jeopardising your filesystem integrity. The magic SysRq keys are enabled in the kernel, so if it’s not compiled into your kernel, you won’t be able to use it. To check if it’s enabled, run these two commands:

cat /boot/config-`uname -r` | grep CONFIG_MAGIC_SYSRQ

This will give you:


if it is enabled. You also need to check it’s not disabled after boot. So type:

cat /proc/sys/kernel/sysrq

The output should be:


So … if the magic SysRq keys are enabled, you can safely shut down by pressing the following key combinations in the following order:

  • Alt+SysRq+K – Kills all processes (SIGKILL / kill -9)
  • Alt+SysRq+E – Terminates all processes (SIGTERM / kill -15)
  • Alt+SysRq+I – Interrupts all processes (SIGINT / kill -2)
  • Alt+SysRq+U – Force unmount and remount of all filesystems readonly
  • Alt+SysRq+S – Syncs all disks
  • Alt+SysRq+B – Reboots

After that the computer should reboot. Good as new, just like a bought one.