I wish to kill a service with a "sytemctl kill logstash.service" but SIGTERM is received by the service, instead of a SIGKILL. How do I send SIGKILL?

Question

A new logstash version I'm using can't stop, attempting to connect to Elastic all the time, while it can't (an authentication trouble, I will resolve later).

a sudo systemctl stop logstash.service isn't enough to stop it, so I've issued a sudo systemctl kill logstash.service.

But it doesn't stop it neither.

a sudo system status logstash.service displays:

lebihan@debian:~$ sudo systemctl kill logstash.service

lebihan@debian:~$ sudo systemctl status logstash.service
● logstash.service - logstash
     Loaded: loaded (/lib/systemd/system/logstash.service; disabled; preset: enabled)
     Active: deactivating (stop-sigterm) since Sun 2023-08-20 07:51:21 CEST; 1h 4min ago
   Main PID: 47926 (java)
      Tasks: 176 (limit: 76997)
     Memory: 1.6G
        CPU: 28min 605ms
     CGroup: /system.slice/logstash.service
             └─47926 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.eg>

août 20 08:55:36 debian logstash[47926]: [2023-08-20T08:55:36,702][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://l>
août 20 08:55:41 debian logstash[47926]: [2023-08-20T08:55:41,704][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://l>
août 20 08:55:42 debian systemd[1]: logstash.service: Sent signal SIGTERM to main process 47926 (java) on client request.
août 20 08:55:42 debian logstash[47926]: [2023-08-20T08:55:42,326][WARN ][logstash.runner          ] SIGTERM received. Shutting down.
août 20 08:55:46 debian logstash[47926]: [2023-08-20T08:55:46,706][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"ht

Why isn't my systemctl kill sending a SIGKILL event, instead of a SIGTERM?
And how do I send a SIGKILL to my service to force it to stop, with systemctl?

@A.B Thanks. I read your link to another SO question already, but doesn't reply to my problem. How do I kill with a SIGKILL my service if `systemctl kill` doesn't work? — Marc Le Bihan, Aug 20 '23 at 07:19
Are you sure? check about "KillSignal=" and "--signal=" in the answer — A.B, Aug 20 '23 at 07:20
@A.B. Then why don't you answer with that? My problem isn't the difference between systemctl stop and kill, it's to stop a service. — Marc Le Bihan, Aug 20 '23 at 07:24

score 3 · Accepted Answer · answered Aug 20 '23 at 07:30

The documentation about systemctl kill never tells it will send a SIGKILL by default:

kill PATTERN…

Send a UNIX process signal to one or more processes of the unit. Use --kill-whom= to select which process to send the signal to. Use --signal= to select the signal to send. Combine with --kill-value= to enqueue a POSIX Realtime Signal with an associated value.

Unless told otherwise, systemctl kill will use the signal defined in the service.

To actually send a SIGKILL to the service someservice one should do:

systemctl kill --signal=SIGKILL someservice

Additional details can be found in this Q/A.

See also [`systemd.kill(5)`](https://www.freedesktop.org/software/systemd/man/systemd.kill.html). — user3840170, Aug 20 '23 at 18:04

I wish to kill a service with a "sytemctl kill logstash.service" but SIGTERM is received by the service, instead of a SIGKILL. How do I send SIGKILL?

1 Answers1