kill -9 is the sledgehammer everyone reaches for, and the one you should reach for last. Understanding the difference between a polite request and a forced termination is the gap between a clean restart and a corrupted database.
kill sends a signal, not a bullet
kill <pid> sends SIGTERM (15) — a request to shut down. A well-behaved process catches it, flushes its buffers, closes files, and exits cleanly. This is what you want almost every time. kill -9 <pid> sends SIGKILL, which the kernel enforces immediately — the process gets no chance to clean up. Use it only when SIGTERM has clearly failed.
Why -9 first is a trap
SIGKILL can leave half-written files, stale lock files, and orphaned shared memory because the process never ran its shutdown path. For a database or anything with on-disk state, that's how a quick "just kill it" becomes an afternoon of recovery. Give SIGTERM a few seconds first.
Find the PID
top # live view; note the PID of the hog, press q to quit ps aux --sort=-%cpu | head pgrep -a nginx # PIDs matching a name, with their command line
To kill every process by name at once, pkill nginx or killall nginx (add -9 only if they ignore the polite signal).
The escalation ladder
For a managed service, skip kill entirely and use systemctl restart <unit> — systemd stops it cleanly and brings it back. Only drop to kill → wait → kill -9 for a rogue process (a stuck script, or malware like a cryptominer) that nothing else manages.
Practise spotting and killing the right process
Hunting a rogue high-CPU process with top and killing the correct PID is a core move in the simulator. Drill it with Linux troubleshooting practice and a full incident response shift.