How to Find and Kill a Process on Linux (ps, kill, pkill and Port in Use)
Something's stuck, hogging the CPU, or sitting on a port you need. On Linux every running program is a process with a number (the PID), and you can stop any of them with kill. Here's how to find the right one and how to stop it without taking anything else down.
Quick reference
| Task | Command | |
|---|---|---|
| Find a process by name | pgrep -a nginx or `ps aux | grep nginx` |
| Stop it politely | kill 1234 | |
| Force it | kill -9 1234 | |
| Stop all with a name | pkill nginx | |
| What's using port 80? | `sudo ss -tlnp | grep :80 or sudo lsof -i :80` |
| Stop a service properly | sudo systemctl stop nginx |
1. Find the process
pgrep -a python
Lists every process whose name contains "python" with its PID and full command. Or the classic:
ps aux | grep python
The second column is the PID. (The grep command itself shows up in the list — ignore that one.)
2. Kill it
kill 1234
This sends SIGTERM: "please shut down cleanly". Most programs save their work and exit within a second or two. Give it a moment, then check with pgrep again.
If it ignores you:
kill -9 1234
SIGKILL can't be ignored. The process is removed instantly, without saving anything — use it as the second step, not the first.
3. Kill by name
pkill python
pkill -9 python
Stops every matching process. Be careful with short names: pkill ssh would also kill your own SSH session. pkill -f "bot.py" matches against the full command line, which is more precise.
4. If it's a service, stop it properly
If the program is managed by systemd, killing it may just make systemd restart it. Use:
sudo systemctl stop name
5. "Address already in use" — what's on that port?
sudo ss -tlnp | grep :8080
The output ends with something like users:(("node",pid=4521,fd=18)). There's your PID. Or:
sudo lsof -i :8080
Kill it, or change your program's port.
Processes you don't own
If kill says "Operation not permitted", the process belongs to root or another user. Add sudo.
Troubleshooting
Killed it but it came straight back. It's a service (systemctl stop it), a cron job, or a Docker container (docker ps, then docker stop name).
kill -9 and it's still there, marked or Z. It's a zombie — already dead, just not cleaned up by its parent. It uses no resources. Killing the parent process (shown in ps -o ppid= -p PID) clears it, or it goes at the next reboot.
Status D in ps and it won't die. It's stuck waiting on disk or network I/O. Nothing can kill it until the I/O returns; check the disk and network, or reboot.
You killed your own terminal. Reconnect with SSH. Nothing else was affected.
Wrapping up
pgrep -a to find it, kill PID to ask nicely, kill -9 if it won't listen, ss -tlnp when a port is taken. And if it's a service, use systemctl stop instead so it stays stopped.
