Signals#

Concepts#

What Is a Signal?#

A signal is a software notification sent to a process. Signals tell processes to do something: stop, terminate, reload configuration, or respond to a user action. They are the kernel’s way of communicating with processes.

When you press Ctrl + C, you are sending a signal. When you run kill 1234, you are sending a signal.

Common Signals#

Signal Number Default Action Sent By
SIGHUP 1 Terminate Terminal closes, or kill -1. Many daemons reload config.
SIGINT 2 Terminate Ctrl + C
SIGQUIT 3 Terminate + core dump Ctrl + \
SIGKILL 9 Kill immediately kill -9. Cannot be caught or ignored.
SIGTERM 15 Terminate gracefully kill (default signal). Process can clean up.
SIGSTOP 19 Suspend process Cannot be caught or ignored.
SIGTSTP 20 Suspend process Ctrl + Z. Can be caught by the process.
SIGCONT 18 Resume a stopped process kill -CONT or fg/bg
SIGUSR1 10 User-defined Application-specific
SIGUSR2 12 User-defined Application-specific

SIGTERM vs SIGKILL#

This is the most important distinction:

SIGTERM (15) — “Please shut down.”

  • The process receives the signal and can handle it.
  • It can save state, close files, release resources, and exit cleanly.
  • This is the default signal sent by kill.

SIGKILL (9) — “Die. Now.”

  • The kernel terminates the process immediately.
  • The process cannot catch, block, or ignore it.
  • No cleanup happens. Files may be left open, data may be lost.
  • Use only as a last resort when SIGTERM does not work.

The right approach:

# Step 1: Ask nicely (SIGTERM)
kill 1234
# Wait a few seconds...

# Step 2: If it didn't stop, force kill (SIGKILL)
kill -9 1234

Sending Signals#

kill — Send a Signal to a Process#

Despite the name, kill sends any signal, not just kill:

kill 1234                  # SIGTERM (default) to PID 1234
kill -15 1234              # SIGTERM (explicit)
kill -9 1234               # SIGKILL (force kill)
kill -1 1234               # SIGHUP (often: reload config)
kill -SIGTERM 1234         # SIGTERM by name
kill -STOP 1234            # Suspend the process
kill -CONT 1234            # Resume a suspended process

killall — Kill by Name# 

killall firefox            # SIGTERM to all processes named "firefox"
killall -9 firefox         # SIGKILL to all firefox processes
killall -u kmiguel python3 # Kill all python3 processes by user kmiguel

pkill — Kill by Pattern# 

pkill firefox              # SIGTERM to processes matching "firefox"
pkill -9 -f "python script.py"  # SIGKILL to processes whose full command matches
pkill -u kmiguel           # Kill all processes by user (dangerous!)

The difference: killall matches the exact process name. pkill matches a pattern (substring). pkill -f matches the full command line.

Listing Signals# 

kill -l                    # list all signals with their numbers
# 1) SIGHUP  2) SIGINT  3) SIGQUIT  ... 9) SIGKILL ... 15) SIGTERM ...

Keyboard Signals#

Keys Signal Effect
Ctrl + C SIGINT (2) Interrupt — ask process to terminate
Ctrl + Z SIGTSTP (20) Suspend — pause the process
Ctrl + \ SIGQUIT (3) Quit — terminate and dump core (for debugging)

How Processes Handle Signals#

Programs can define signal handlers — functions that run when a specific signal arrives:

# Example: A well-written web server receiving SIGTERM
# 1. Stops accepting new connections
# 2. Finishes handling current requests
# 3. Closes database connections
# 4. Writes any buffered logs
# 5. Exits cleanly

# A program receiving SIGKILL
# None of the above happens — instant death

Programs cannot handle two signals: SIGKILL (9) and SIGSTOP (19). These are enforced by the kernel.

Lab#

Exercise 1: Sending Signals with kill# 

# Start a background process
sleep 600 &
MYPID=$!
echo "Started sleep with PID: $MYPID"

# Check it's running
ps -p $MYPID

# Send SIGTERM (graceful)
kill $MYPID

# Verify it's gone
ps -p $MYPID
# Should show nothing

Exercise 2: SIGKILL vs SIGTERM# 

# Start a background process
sleep 600 &
PID1=$!

# Try SIGTERM
kill $PID1
ps -p $PID1    # should be gone

# Start another
sleep 600 &
PID2=$!

# Force kill with SIGKILL
kill -9 $PID2
ps -p $PID2    # gone immediately

Exercise 3: Suspend and Resume# 

# Start a foreground process
sleep 300

# Press Ctrl+Z to suspend it
# [1]+  Stopped  sleep 300

# It's still there, just stopped
jobs
ps aux | grep "sleep 300" | grep -v grep

# Resume in background
bg %1
jobs
# [1]+  Running  sleep 300 &

# Suspend it again (from background — use kill)
kill -STOP %1
jobs
# [1]+  Stopped  sleep 300

# Resume again
kill -CONT %1
jobs

# Clean up
kill %1

Exercise 4: killall and pkill# 

# Start several background processes
sleep 500 &
sleep 501 &
sleep 502 &

# List them
jobs
ps aux | grep "sleep 50[0-9]"

# Kill all sleep processes
killall sleep

# Verify
jobs

# Start more
sleep 600 &
sleep 601 &

# Kill using pkill (pattern match)
pkill -f "sleep 60"

# Verify
jobs

Exercise 5: Signal List and Keyboard Signals# 

# List all signals
kill -l

# Start an interactive process
cat
# (cat waits for input)

# Press Ctrl+C — sends SIGINT, cat terminates

# Start another
cat
# Press Ctrl+Z — sends SIGTSTP, cat suspends
jobs
# Kill the stopped job
kill %1

# Start cat again
cat
# Press Ctrl+\ — sends SIGQUIT (may dump core)
# You might see "Quit (core dumped)"

Exercise 6: Process Monitoring Scenario# 

# Simulate finding and killing a stuck process

# Start a "stuck" process
while true; do sleep 1; done &
STUCK_PID=$!
echo "Stuck process: $STUCK_PID"

# Find it
ps -p $STUCK_PID

# Try SIGTERM
kill $STUCK_PID

# Verify
ps -p $STUCK_PID

# If it were truly stuck and SIGTERM didn't work, you would use:
# kill -9 $STUCK_PID

Review#

1. What is a signal?

A software notification sent to a process by the kernel, another process, or the user. It tells the process to perform some action: terminate, suspend, reload configuration, etc.

2. What is the difference between SIGTERM and SIGKILL?

SIGTERM (15) asks the process to terminate gracefully — the process can catch it, clean up resources, and exit. SIGKILL (9) immediately terminates the process — it cannot be caught or ignored, no cleanup occurs. Always try SIGTERM first; use SIGKILL only as a last resort.

3. What signal does Ctrl+C send?

SIGINT (2) — interrupt signal. It asks the foreground process to terminate.

4. What signal does Ctrl+Z send?

SIGTSTP (20) — terminal stop signal. It suspends the foreground process (which can be resumed with bg or fg).

5. What is the difference between `kill`, `killall`, and `pkill`?

kill PID sends a signal to a specific process by PID. killall name sends a signal to all processes with that exact name. pkill pattern sends a signal to processes matching a pattern (substring of the name, or with -f, the full command line).

6. Which two signals cannot be caught or ignored?

SIGKILL (9) and SIGSTOP (19). These are enforced by the kernel regardless of what the process wants.

7. What does SIGHUP commonly do for daemon processes?

Many daemon processes (web servers, syslog, etc.) interpret SIGHUP as “reload your configuration file without restarting.” This convention comes from the signal’s original meaning: the terminal “hung up.”

Previous: Processes and Job Control | Next: systemd and Services