Why Can't I Kill My Process?

Answer

This document applies to all AIX versions 4 and 5.

To kill a process

Sometimes it is necessary to eliminate a process entirely. This is the purpose of the kill command. The syntax of the kill command, which is actually a general purpose process signalling utility, is as follows:

    kill [-signal] PID 

The kill command (or kill -15 which is the default signal) sends a SIGTERM signal to a process. This signal can be trapped, thus ignored by a process.

The kill -9 command sends a SIGKILL command to the process. If the process is currently in USER mode, this signal cannot be caught or trapped and the process will terminate.

Occasionally, processes will not die even after being sent the kill signal. The majority of such processes fall into one of the following categories:

• Zombies. A process in the zombie state (displayed as Z status in BSD ps displays and as <defunct> under System V). A zombie process is one in which all its resources have been freed, but the parent process's acknowledgment has not occurred. Zombies are always cleared the next time the system is booted and do not adversely affect system performance.
• Processes in kernel mode waiting for unavailable resources.

There are two modes a process can be in, USER mode and KERNEL mode.

The process goes into kernel mode anytime it needs to access system functions via a system call routine. While in the kernel mode, signals are ignored until the system call exits back to user mode. At that time, any pending signals are handed to the user process.

If while in kernel mode, the process goes to sleep while waiting on a resource and the resource never becomes available, the process will never exit kernel mode.

The only way to kill a process that is "ignoring" or "sleeping" in kernel mode is to restart the system.

NOTE: Signals are defined in the /usr/include/signal.h file and the command kill -l may be used to generate a list of their symbolic names.

Delivery of signals to a system call

The kernel delays the delivery of all signals, including SIGKILL, when starting a system call, device driver, or other kernel extension. The signal takes effect upon leaving the kernel and returning from the system call. This happens when the process returns to the user protection domain, just before running the first instruction at the caller return address.