kill -9 is a reflex for a lot of engineers, and it's usually the wrong first move. It works because it can't be caught — which is exactly why it's dangerous. Here's how signals actually work and the right escalation order.
What the signals mean
| Signal | Number | Catchable? | Use |
|---|---|---|---|
| SIGTERM | 15 | yes | polite "please shut down" — default for kill |
| SIGINT | 2 | yes | what Ctrl-C sends |
| SIGHUP | 1 | yes | reload config (many daemons) |
| SIGKILL | 9 | no | last resort — skips all cleanup |
SIGTERM gives the process a chance to flush buffers, close files, and finish in-flight requests. SIGKILL yanks the rug — open files may be left mid-write, locks unreleased, temp files orphaned. Always start at 15.
The right escalation
Why a process won't die even with -9
A process stuck in uninterruptible sleep (state D) ignores every signal, including 9, because it's blocked in a kernel syscall — usually waiting on dead storage or a hung NFS mount:
You cannot kill a D-state process. You fix the thing it's waiting on (remount, reconnect storage) and it unblocks.
Zombies — already dead, can't be killed
A zombie (Z state) is a finished process whose parent hasn't read its exit status. It uses no resources but holds a PID:
You don't kill a zombie — it's already dead. You signal its parent to reap it (or restart the parent). Killing the zombie does nothing.
See what a hung process is doing
strace -p attaches live and shows the syscall it's stuck on. A process frozen on a read() from a dead socket tells you exactly what to fix.
SIGKILL doesn't "force harder" — it just skips cleanup. If 15 didn't work, understand why before you reach for 9.