pkill is a Unix-like command that sends a signal to processes matched by name, user, or other criteria. It is a higher-level alternative to targeting a single process ID with kill, and can stop multiple matching processes at once.
What pkill does in a Unix-like system
pkill is a process-targeting command, not a low-level PID tool. It lets an operator match processes by name, owner, terminal, session, or other criteria, then send a signal to every process that fits the selector.
The practical difference is scale and convenience: where kill acts on one known process ID, pkill acts on a pattern. That makes it useful for service restarts, cleanup after a test run, and fast shutdown of a family of related processes.
How pkill matches processes
pkill depends on the process table and the selector semantics provided by the operating system. Matching by name is the most familiar use, but selectors can also reflect user context, controlling terminal, parentage, or other attributes exposed by the platform.
That flexibility is powerful, but it also means the command is only as safe as the pattern you choose. A broad selector can catch more processes than intended, especially in shared environments where multiple applications or users have similar names or runtime traits.
Because pkill works by criteria rather than a single PID, it is closer to an operational search-and-act command than a pure termination primitive. Administrators often use it when the exact PID is unknown but the process class is known.
Signals, termination, and control effects
pkill does not inherently destroy a process, it sends a signal. The default signal is commonly termination-oriented, but the exact outcome depends on the signal sent and how the target process handles it. Some processes exit cleanly, while others trap, ignore, or delay shutdown.
This is important for service hygiene. A graceful stop can allow cleanup, state flushes, and log completion, while a forceful signal can interrupt work in progress. The same command can therefore support both orderly maintenance and abrupt interruption, depending on usage.
For operational work, the main distinction is intent: pkill is a selection mechanism plus signal delivery. The command itself does not guarantee a clean shutdown, and it does not guarantee that only the intended workload will be affected.
Where pkill fits in operational and security practice
In day-to-day administration, pkill is useful for recovering from stuck jobs, clearing test artifacts, or stopping a repeated crash loop. It is also relevant in security operations because the same capability can be used to suppress monitoring agents, terminate defensive tooling, or disrupt a suspicious process family if permissions allow.
That dual use means the command is often governed by operating-system privilege boundaries and shell access controls rather than by the command alone. The real security question is who can invoke it, against which processes, and under what constraints.
In practice, orgs treat process-control commands as part of administrative power, not just convenience tooling. When used carefully, they reduce manual effort; when used loosely, they can widen the blast radius of a mistaken or malicious action.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | pkill’s impact depends on who is allowed to signal which processes. |
| IA-2 — Identification and Authentication (Organizational Users) | Using pkill safely depends on authenticated operator access to the host. | |
| Recommendation — Restrict process-killing authority to the minimum administrative roles that need it. Require strong operator authentication before granting shell or administrative access. | ||
| CIS Controls v8 | CIS-4 — Controlled Use of Administrative Privileges | pkill is an administrative action whose misuse can disrupt services or defenses. |
| Recommendation — Limit and monitor administrative accounts that can terminate processes. | ||