Signals — SIGTERM, SIGKILL, SIGHUP, and the rest

Signals are Linux’s asynchronous notification mechanism. A signal is a small integer (1-31 on Linux, with real-time signals above) that the kernel delivers to a process. The process can ignore it, catch it (with a handler), or accept the default action.

The signal list

$ kill -l 2>&1 | head -5

 1) SIGHUP       2) SIGINT       3) SIGQUIT      4) SIGILL
5) SIGTRAP      6) SIGABRT      7) SIGBUS       8) SIGFPE
9) SIGKILL     10) SIGUSR1     11) SIGSEGV     12) SIGUSR2
13) SIGPIPE     14) SIGALRM     15) SIGTERM     16) SIGSTKFLT
17) SIGCHLD     18) SIGCONT     19) SIGSTOP     20) SIGTSTP

Sending signals

$ kill 1234; kill -TERM 1234; kill -KILL 1234; kill -HUP $(pgrep nginx)

...

$ pkill -TERM -f nginx; killall -HUP sshd

...

Catching signals

A process catches a signal by registering a handler via signal() or sigaction(). When the signal arrives, the kernel interrupts the process’s normal flow and calls the handler.

$ cat /tmp/sigterm-demo.sh

#!/bin/bash
LOCK=/tmp/sigterm-demo.lock

cleanup() {
  echo "received SIGTERM, cleaning up"
  rm -f "$LOCK"
  exit 0
}

trap cleanup TERM
trap 'echo "received SIGINT, exiting"; rm -f "$LOCK"; exit 130' INT

echo "PID: $$"
touch "$LOCK"
echo "waiting..."

while true; do
  sleep 1 & wait $!
done

Two details in that script are the whole lesson.

The trap argument is a single word or a quoted string. trap takes the handler as one argument. Writing

trap echo cleaning up; rm -f "$LOCK"; exit 0 TERM

does not install that pipeline as a handler. Bash reads trap echo cleaning up as the trap command, then runs the rest immediately. The safe forms are a function name, as with trap cleanup TERM, or a single-quoted string, as with the SIGINT line. A function name is easier to read and easier to test, because you can call cleanup directly.

A foreground sleep delays the handler. Bash does not interrupt a foreground child to run a trap. It waits for the child to exit, then runs the handler. With a plain sleep 1 the delay is invisible; with sleep 300 in a polling loop the process appears to ignore SIGTERM for five minutes, systemd hits TimeoutStopSec, and SIGKILL arrives with the cleanup never having run. Backgrounding the sleep and calling wait fixes it: wait is interruptible, so the handler fires immediately.

$ ./sigterm-demo.sh & echo $!; sleep 5; kill -TERM $!; wait $!

PID: 12345
waiting...
received SIGTERM, cleaning up

Catching vs blocking vs ignoring

Three options when a signal arrives:

$ trap '' TERM; sleep 60

...

Real-time signals

Linux supports real-time signals from SIGRTMIN (typically 32) to SIGRTMAX. Real-time signals:

• Carry a sigval_t payload (an integer or a pointer).
• Are queued, not coalesced — multiple instances of the same signal are delivered separately.
• Have a defined delivery order (lower-numbered first; for the same number, by sender’s PID).

$ kill -RTMIN+3 1234

...

Production discipline

Knowledge check