hpr-knowledge-base/hpr_transcripts/hpr1162.txt

Episode: 1162
Title: HPR1162: LiTS 021: killall
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr1162/hpr1162.mp3
Transcribed: 2025-10-17 20:48:21

---

Welcome to Linux in the Shell Episode 20, the Kill All Command.
My name is Dan Washco, I will be your host, and as always I'd like to thank Hacker Public
Radio for sponsoring this show and providing the website and hosting the audio files.
And Hacker Public Radio, it's a great community project, a show a day, during the week, great
stuff, great content, and always looking for contributors, so if you have an idea, head
on over to Hacker Public Radio and share it.
Let's talk about the Kill All Command.
Now in the past two episodes I've focused on Kill and P Kill and P Grab.
And Kill All is the third command I'll talk about in a similar vein of sending a signal
to a process.
And Kill All shares a lot of similarities between P Kill and some differences too.
So some of the stuff I'm going to gloss over because I covered it in more detail than
the other two commands, like exactly what the different signal processes are that you
can send to the process.
So let's jump right into it.
At the heart of it, Kill All just takes the Kill All and then the name of the process,
the command name of the process that you want to terminate.
For instance, Kill All X Term.
What it's going to do is just like P Kill, it's going to attempt to send the SIG term,
which is the default signal, signal number 15, we talked about all of them.
Default signal, SIG term, to all X term processes, just like P Grab or P Kill would.
And if it's successful, it doesn't usually output anything.
But if it fails or it can't kill it or there is no X term process, it'll report that there
aren't any processes or it couldn't kill the process.
Now, like any other command, you have to have permission to kill the process that you're
running.
So if you're a standard user and you're trying to kill the process of another user, it's
not going to work.
Now, if you're a root, you can kill everybody's processes, even your own.
So just be careful of that security measure in place that you can only kill the processes
that you have control over, or if you have some way to gain elevated privileges like
Sudo or SU in the root who has those privileges, you will be able to kill anybody's processes.
Now, Kill All operates on kind of like P Kill does, that it doesn't just necessarily work
on one process, one instance of the process, it's going to work on all instances of the
process executed by the command name that you specify.
Kill All has a limitation of 15 characters of the command name.
So if for instance you have two commands that are different, but share the same 15 characters
and exceed 15 characters in length, Kill All will kill both of those or attempt to kill
both of those, even though they may be different.
Now that can be augmented and actually prevented from happening by using the dash E or the
dash dash exact option, that switch right there, that will explicitly match the first
15 characters and if the command exceeds the 15 characters, it's not going to kill those
processes.
So it will prevent that 15 character limitation process from happening.
Also one good thing to do with the Kill All Command if you want to is the dash V or the
dash dash verbose and what that does is it will report exactly what Kill All is going
to do or has done actually not going to do it is going to has done.
So when you kill a process, it will report the list of processes, the process ID and report
that it's the signal it's sent to.
So you can see what signal it sends by doing the dash V and that's pretty handy.
Now you can put Kill All into an interactive mode with the dash I or dash dash interactive
and what will happen is before it actually sends the signal, it will prompt you for confirmation.
The default is an end so if you just hit enter, it's going to send no, it won't send
the signal but you hit Y for yes and it will then kill that or send that signal to the
process.
Again the default signal just like all the other Kill commands is SIG term or dash 15,
I'm going to SIG term ID is 15, you can change the signal in a variety of ways, similar
to Kill and P Kill with the dash I or dash dash signal command right there switch.
Then you can specify either the number like nine for the Kill process or SIG Kill or
just Kill, similarly you could do Kill all dash nine, Kill all dash SIG Kill or Kill
all dash Kill and that all does the same thing as the dash S with the process ID or the
signal that you're sending.
So it's a Kill all shares that same functionality in there.
Another shared functionality is the dash L or dash dash list which will list all known
signal names.
Now unlike the other processes, Kill and P Kill, it'll only list the names of the signals
without the SIG prefix on it so you're just getting the names of the signals.
So it's not as verbose or flexible as it is and Kill just be aware of that.
Kill all has a quiet mode, dash Q or dash dash, quiet what that does is it suppresses the
output of a non-successful iteration of the command.
So if you did Kill all dash Q X term and there was no X term process running or you didn't
have permissions, it would suppress the output of the Kill all command.
Very, very, very simple command to use.
Couple switches for how to handle which processes to Kill.
Again, like I said, Kill all is pretty exclusive of the command name.
So if you do X term, you're going to Kill all X terms.
Now it has even more flexibility with being able to handle regular expressions with the
dash R or the dash dash Reg XP.
So if you were to do Kill all dash R space term, it's going to search in all the processes
for any process that has term in the name.
So not only will it Kill X term, A term, Gnome term, Gnome dash term is, I think what it
actually is, Gnome dash, sorry, Gnome dash terminal or dash E term, I'm, yeah, dash E,
it's E term with a capital E term.
It will kill all those processes right there if you just do regular expression R. Similarly,
if you want to do a wild card character, you will probably have to escape it with a
black backslash.
So Kill all dash R, backslash, asterisk, term will again work just like killing term
did itself.
It will kill any process that has term in it.
Now you can do something like Kill all dash R, open bracket, not curly bracket, open
bracket, A, X, close bracket, term, and that will only kill any process called A term
or X term.
It will not kill E term or Gnome terminal, Gnome dash term.
So regular expressions can be used.
Another way to limit or expand on what Kill all can, execute is Kill all dash U or dash
user and that will only kill the processes specified or kill the process of the specified
user.
So for example, Kill all dash U, space, Dan will kill all the processes or send the
signal, SIG term to all the processes owned by user Dan.
Of course, you can limit that by specifying the name of the command, also Kill all dash
U, Dan, space, X term, but only kill X term processes under the user Dan.
So be aware of that further limitation.
But if you just did the user name, it would kill, offer to kill all the processes under
that user's control.
Here's a process group, ID that you can pass, which is the dash G or the dash dash process
dash group.
Now this works a little differently than you might expect, you're not going to pass
a group ID.
Oh, before I forget, when using user, dash user, ID, you have to specify the user name.
It doesn't accept the user ID or at least the versions of Kill all that I have used do
not accept it.
Be aware of that.
Now back to process group with the dash G or dash, dash process, dash group.
You can get the process group ID through top or PS or whatever.
And you can see what process group, a specific process is that you want to kill.
Now the way that this works is you specify the process group ID.
And what that will do is it will kill.
You would think that you would specify the process group ID and it would kill any processing
that process group ID.
No, that's not how it works.
You say dash G and then X term and what it does is it looks at the X term process or multiple
X term processes that are in there.
And it will kill all the processes that are in the same process group ID as the X term.
So be very careful with that.
It's going to take the command and look at the process group ID it's in and attempt to
kill all those processes in that process group ID.
It's not you specifying a process group ID.
It's you specifying a process command that's in that and it kills the process group ID.
So just be aware of that.
Again, if you are not careful, you could easily go and wipe out the entire process group
ID for not only your user, but all other users on the system.
If you have permission to do so, like as root.
If you executed kill all dash G X term, it would look for all of the X term processes
in there and their process group ID and kill every process in that process group ID.
Pretty much wiping out most of the session of any other user that's in that on that
system that might be using X also had an X term open.
So just be very careful.
It can be very dangerous, more dangerous than just kill all in a process.
There are two time related options.
One is dash O or dash dash older dash then and dash Y or dash dash younger dash then.
And when it works is you provide a time stamp.
Time stamp is in the format of a floating point number and a time reference, a time code.
We'll call it time code, so to speak.
Now those time codes are S for seconds, M for minutes, H for hour, D for day of the
month, W for weeks, capital M for month and Y for year.
All right, so the way that you specify it is, let's say you wanted to kill all process or kill
off an X term process that was started after 10 30 AM on December 31st, 2012, well, you
can specify.
So you want to after it was all those that are after.
So it's got to be younger than the time stamp.
So that would be dash Y and then the format would basically be 10 M 30, I'm sorry, 10 H
for hour, 30 M from 30 minutes.
You don't have to specify seconds, but you can say zero, zero, ask for seconds.
And then 12, capital M for 12 month, 31 D for the 31st day and 2012 Y for the year.
So that's how you specify it and then X term.
So it's number and then time label, again, like 10 M would be the 10th minute, 10 H would
be the 10th hour, very simple, little kind of clergy when you think about it, but it's
very simple.
It's not that hard to remember, kill all, dash W or W dash, dash, wait, what that will
do is instead of the way kill all would actually work is it would kill all X term would send
the signal to all the X term processes running and then exit.
Whereas if you do the dash W, kill all is going to go into a waiting state and it's going
to send the signal and make sure it gets a response from those processes, which could
cause kill all the hang indefinitely if the process is not accepting signals or isn't
a zombie state that's ignoring the signal.
And so you'd have to manually kill it there, but it would kill all would just not stop.
It would just keep attempting to see whether or not the process died checking once per
second and it could end up in a loop.
That pretty much covers kill all except for one other option, which is SE Linux only.
That's the dash capital Z or dash dash context.
And what that does is you're allowed to specify a security context.
So it will only kill the processes having the serity context that match the ID that you
given.
Now you can do the ID or the context as a specific ID or you can do a regular expression
of the context and also be aware that in order to use the dash Z or context option, you
have to specify that as the first argument.
Other command names are optional.
Other arguments are optional, but that one has to be in the first argument to the kill
all command.
So that's it folks.
That's kill all in a nutshell right there.
Head on over to the website for the full write up, the bibliography and the watch the
video.
And again, I thank you for listening and I thank Hacker Public Radio for hosting the
sites.
You have been listening to Hacker Public Radio at Hacker Public Radio.
We are a community podcast network that releases shows every weekday Monday through Friday.
Today's show, like all our shows, was contributed by a HBR listener like yourself.
If you ever consider recording a podcast, then visit our website to find out how easy
it really is.
Hacker Public Radio was founded by the Digital Dark Pound and the Infonomicom Computer
Club.
HBR is funded by the Binary Revolution at binref.com, all binref projects are crowd-responsive
by lunar pages.
From shared hosting to custom private clouds, go to lunarpages.com for all your hosting
needs.
Unless otherwise stasis, today's show is released under a creative commons, attribution,