Signals - Learning Module

Loading content...

0/240

Common Signals: The UNIX Signal Vocabulary

Learning the Signal Language

When you press Ctrl+C to stop a runaway process, you're sending SIGINT. When the kill command terminates an unresponsive daemon, it's sending SIGTERM. When a segmentation fault crashes your program, the kernel delivers SIGSEGV. These aren't arbitrary names—they're the vocabulary of process communication in UNIX-like systems.

Just as a doctor must know the names and functions of human organs, a systems programmer must know the names and purposes of standard signals. This knowledge enables you to:

Interpret log messages and crash reports correctly
Choose appropriate signals for process management
Implement handlers for signals that matter to your application
Understand system behavior in failure scenarios

This page catalogs the signals you'll encounter most frequently, explaining not just what they are but when you'll see them and why they exist.

What You Will Learn

By the end of this page, you will have a working knowledge of 25+ standard signals, organized by function. You'll understand their default behaviors, common generation sources, and best practices for handling them in production systems.

Process Termination Signals

The most common use of signals is to terminate processes—gracefully or forcefully. Understanding the hierarchy of termination signals is essential for proper process management.

SIGTERM (Signal 15): The Polite Termination Request

Default action: Terminate

SIGTERM is the "gentleman's request" to terminate. It says: "Please shut down cleanly at your earliest convenience." Key characteristics:

Catchable and ignorable: Processes can install handlers to perform cleanup
Default signal for kill command: Running kill <pid> sends SIGTERM by default
Industry convention: Well-behaved daemons should terminate gracefully on SIGTERM

Best practice: Always handle SIGTERM for long-running processes. Your handler should:

Stop accepting new work
Complete in-progress work (if quick) or cancel cleanly
Release resources (close files, flush buffers, release locks)
Exit with appropriate status code

graceful_shutdown.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
 
volatile sig_atomic_t shutdown_requested = 0;
 
void sigterm_handler(int sig) {
    shutdown_requested = 1;
    /* 
     * Do NOT call printf, malloc, exit, or other non-async-signal-safe
     * functions here. Only set flags and let main loop handle cleanup.
     */
}
 
void cleanup() {
    printf("Performing graceful shutdown...
");
    /* Flush buffers, close connections, release locks */
    printf("Cleanup complete. Exiting.
");
}
 
int main() {
    struct sigaction sa;
    
    sa.sa_handler = sigterm_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = 0;
    
    sigaction(SIGTERM, &sa, NULL);
    sigaction(SIGINT, &sa, NULL);  /* Also handle Ctrl+C gracefully */
    
    printf("Server running (PID %d). Send SIGTERM to shutdown gracefully.
", getpid());
    
    /* Main work loop */
    while (!shutdown_requested) {
        printf("Working...
");
        sleep(2);  /* Simulate work */
    }
    
    cleanup();
    return 0;
}

SIGKILL (Signal 9): The Guaranteed Terminator

Default action: Terminate (cannot be caught, blocked, or ignored)

SIGKILL is the nuclear option. The kernel terminates the process immediately—no handler runs, no cleanup occurs. Use cases:

Terminating processes that ignore SIGTERM
Emergency resource reclamation
System shutdown procedures

Warning: SIGKILL should be a last resort. Using it routinely causes:

Corrupted files from unflushed writes
Orphaned resources (shared memory, temporary files)
Broken database transactions
Unnotified dependent services

Convention: Send SIGTERM first, wait a grace period (e.g., 10 seconds), then SIGKILL if necessary.

SIGINT (Signal 2): Interactive Interrupt

Default action: Terminate

SIGINT is generated by Ctrl+C in the terminal. It's intended for interactive interrupt—user wants to stop what's happening NOW. Characteristics:

Sent to entire foreground process group
Catchable—handlers can perform quick cleanup
Conventional meaning: "User wants out of current operation"

Handler strategy: SIGINT handlers should be quick. The user is waiting. If cleanup is lengthy, acknowledge receipt immediately and timeout if needed.

SIGQUIT (Signal 3): Quit with Core Dump

Default action: Terminate + core dump

SIGQUIT is generated by Ctrl+\ (backslash). It's a stronger interrupt request with diagnostic intent—"terminate, but leave a core dump for debugging." Use when SIGINT doesn't help and you want to investigate why.

SIGHUP (Signal 1): Hangup

Default action: Terminate

SIGHUP originally meant "terminal hung up" (modem disconnected). Modern uses:

Terminal close notification: Sent to foreground process group when terminal closes
Configuration reload convention: Daemons often reread configuration on SIGHUP instead of terminating

# Common daemon pattern: reload config without restart
kill -HUP $(cat /var/run/nginx.pid)

This dual meaning (terminate vs. reload) depends on context—daemons that detach from terminals typically interpret SIGHUP as reload.

Termination Signals Summary
Signal	Number	Default	Generated By	Typical Use
SIGTERM	15	Terminate	`kill <pid>`, system shutdown	Graceful termination request
SIGKILL	9	Terminate	`kill -9 <pid>`	Forced termination (last resort)
SIGINT	2	Terminate	Ctrl+C	Interactive interrupt
SIGQUIT	3	Terminate + core	Ctrl+\	Debug termination
SIGHUP	1	Terminate	Terminal close, shell logout	Reload config (daemons)

Production Best Practice

Never use kill -9 as your first attempt. Always SIGTERM first, wait, then SIGKILL. Container orchestrators (Kubernetes, Docker) follow this pattern: SIGTERM with a grace period (default 30s), then SIGKILL. Applications that ignore SIGTERM cause unnecessary forced terminations and potential data loss.

Error and Exception Signals

Error signals indicate that something went wrong during program execution. They are typically synchronous—generated by the process's own faulty actions—and often indicate bugs that need fixing rather than conditions to handle gracefully.

SIGSEGV (Signal 11): Segmentation Violation

Default action: Terminate + core dump

SIGSEGV is the most famous (infamous?) signal—the dreaded "segmentation fault." It indicates invalid memory access:

Dereferencing NULL or wild pointers
Accessing memory beyond array bounds
Writing to read-only memory (text segment, const data)
Stack overflow from deep recursion

Can you catch SIGSEGV? Technically yes, but recovery is difficult:

The process state is corrupt—you don't know what else is damaged
Returning from handler normally re-executes the faulting instruction (infinite loop)
Jumping elsewhere (via siglongjmp) may work but leaves state unclear

Practical approach: Install SIGSEGV handler for logging/diagnostics only, then terminate. Use address sanitizers (ASan) during development to catch these bugs early.

sigsegv_diagnostic.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <execinfo.h>  /* For backtrace - Linux/glibc */
 
void sigsegv_handler(int sig, siginfo_t *info, void *context) {
    void *array[50];
    int size;
    
    fprintf(stderr, "
=== SEGMENTATION FAULT ===
");
    fprintf(stderr, "Signal: %d
", sig);
    fprintf(stderr, "Fault address: %p
", info->si_addr);
    fprintf(stderr, "
Backtrace:
");
    
    /* Get backtrace - note: not async-signal-safe, but we're crashing anyway */
    size = backtrace(array, 50);
    backtrace_symbols_fd(array, size, STDERR_FILENO);
    
    fprintf(stderr, "
Core dump will be generated if enabled.
");
    
    /* 
     * Re-raise with default handler to generate core dump.
     * This is the recommended pattern for diagnostic handlers.
     */
    signal(SIGSEGV, SIG_DFL);
    raise(SIGSEGV);
}
 
int main() {
    struct sigaction sa;
    
    sa.sa_sigaction = sigsegv_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_SIGINFO;  /* Use sa_sigaction, not sa_handler */
    sigaction(SIGSEGV, &sa, NULL);
    
    /* Trigger SIGSEGV */
    int *ptr = NULL;
    *ptr = 42;  /* Crash here */
    
    return 0;
}
 
/*
 * Compile: gcc -rdynamic sigsegv_diagnostic.c -o segv_demo
 * The -rdynamic flag includes symbol names in backtrace.
 */

SIGFPE (Signal 8): Floating-Point Exception

Default action: Terminate + core dump

Despite the name, SIGFPE covers all arithmetic exceptions, not just floating-point:

Integer division by zero
Integer overflow (on some architectures)
Floating-point divide by zero (if FPE traps enabled)
Floating-point overflow/underflow (if traps enabled)
Invalid floating-point operation (e.g., sqrt of negative)

Note: By default, IEEE 754 floating-point operations do NOT raise SIGFPE—they produce special values (Inf, NaN). SIGFPE for FP requires enabling traps via feenableexcept() (Linux/glibc).

SIGBUS (Signal 7): Bus Error

Default action: Terminate + core dump

SIGBUS indicates a bus error—hardware-level memory access problem:

Misaligned memory access (on architectures that require alignment)
Accessing memory-mapped file beyond file size (after mmap)
Non-existent physical address (rare on modern systems with MMU)

Difference from SIGSEGV: SIGSEGV = valid address, no permission. SIGBUS = physical access failure.

SIGILL (Signal 4): Illegal Instruction

Default action: Terminate + core dump

SIGILL indicates the CPU encountered an instruction it cannot execute:

Corrupted executable code (binary manipulation, buffer overflow)
Executing code compiled for different architecture (e.g., AVX on non-AVX CPU)
JIT compilation bugs generating invalid opcodes
Hardware failure corrupting instruction fetch

This signal is rare in normal operation—it usually indicates severe corruption or hacking attempts.

SIGABRT (Signal 6): Abort

Default action: Terminate + core dump

SIGABRT is generated programmatically when a process calls abort(). Uses:

assert() failure—the assertion macro calls abort()
C library internal errors (e.g., double-free detected by malloc)
Explicit program abort for unrecoverable errors

Unlike hardware exception signals, SIGABRT is intentional—the program is saying "I detected something wrong and cannot continue."

Error and Exception Signals
Signal	Number	Cause	Common Triggering Bugs
SIGSEGV	11	Invalid memory access	NULL dereference, buffer overflow, stack overflow
SIGFPE	8	Arithmetic exception	Division by zero, integer overflow
SIGBUS	7	Bus/alignment error	Misaligned access, mmap beyond EOF
SIGILL	4	Illegal instruction	Binary corruption, wrong architecture
SIGABRT	6	Abort called	assert() failure, double-free
SIGTRAP	5	Trace/breakpoint trap	Debugger breakpoint, debug trap instruction
SIGSYS	31	Bad system call	Invalid syscall number, seccomp violation

Exit Codes and Signal Numbers

When a process is killed by a signal, its exit status encodes the signal number. The convention is: exit_status = 128 + signal_number. So SIGSEGV (11) gives exit code 139, SIGKILL (9) gives 137. Shell scripts can detect this: if [ $? -gt 128 ]; then echo 'killed by signal'; fi

Job Control Signals

Job control is the shell's mechanism for managing multiple processes—running jobs in background, bringing them to foreground, suspending and resuming. This mechanism is built on a set of dedicated signals.

SIGSTOP (Signal 19): Stop Process

Default action: Stop (cannot be caught, blocked, or ignored)

SIGSTOP unconditionally stops (pauses) a process. Like SIGKILL for termination, SIGSTOP cannot be overridden—it guarantees the process will stop. The process remains in memory, in stopped state, until resumed with SIGCONT.

Use cases:

Debugging: Stop a process for examination
Resource management: Pause low-priority work during peaks
System tools: kill -STOP <pid> to freeze a process

SIGTSTP (Signal 20): Terminal Stop

Default action: Stop

SIGTSTP is the catchable version of SIGSTOP, generated by Ctrl+Z. Unlike SIGSTOP:

Processes can catch it and perform cleanup before stopping
Handler can ignore the stop request (though this breaks user expectations)

Handler pattern for SIGTSTP:

sigtstp_handler.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#include <signal.h>
#include <stdio.h>
#include <unistd.h>
#include <termios.h>
 
struct termios original_termios;
 
void sigtstp_handler(int sig) {
    /* Restore terminal settings before stopping */
    tcsetattr(STDIN_FILENO, TCSANOW, &original_termios);
    
    /* 
     * To actually stop, we must:
     * 1. Reset SIGTSTP to default handler
     * 2. Raise SIGTSTP to stop ourselves
     * 3. When continued, re-install our handler
     */
    signal(SIGTSTP, SIG_DFL);
    raise(SIGTSTP);  /* Now we actually stop */
    
    /* Execution resumes here after SIGCONT */
    signal(SIGTSTP, sigtstp_handler);  /* Re-install handler */
    
    /* Restore our custom terminal settings */
    /* (would restore custom settings here) */
    printf("
Resumed!
");
}
 
int main() {
    tcgetattr(STDIN_FILENO, &original_termios);
    
    struct sigaction sa;
    sa.sa_handler = sigtstp_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_RESTART;
    sigaction(SIGTSTP, &sa, NULL);
    
    printf("Press Ctrl+Z to suspend...
");
    
    while (1) {
        printf("Working...
");
        sleep(1);
    }
    
    return 0;
}

SIGCONT (Signal 18): Continue Stopped Process

Default action: Continue (if stopped); ignore (if running)

SIGCONT resumes a stopped process. Special characteristics:

Always has effect on stopped processes—even if ignored
If a handler is installed, it runs after the process resumes
Cannot be blocked while process is stopped (would deadlock)

Shell job control:

fg %1      # Bring job 1 to foreground (sends SIGCONT)
bg %1      # Resume job 1 in background (sends SIGCONT)

SIGTTIN and SIGTTOU (Signals 21, 22): Background Terminal I/O

Default action: Stop

These signals prevent background processes from interfering with terminal I/O:

SIGTTIN: Background process tried to read from terminal → stopped
SIGTTOU: Background process tried to write to terminal → stopped (if stty tostop is set)

This prevents confusing scenarios where multiple processes fight for terminal input/output.

SIGCHLD (Signal 17): Child Status Changed

Default action: Ignore

SIGCHLD notifies parent processes when child state changes:

Child terminated (normally or abnormally)
Child stopped (by SIGSTOP or SIGTSTP)
Child resumed (by SIGCONT)

This signal is critical for proper process management. Without handling SIGCHLD properly, terminated children become zombies.

Job Control Signals
Signal	Number	Action	Catchable?	Purpose
SIGSTOP	19	Stop	No	Unconditional stop
SIGTSTP	20	Stop	Yes	Terminal stop (Ctrl+Z)
SIGCONT	18	Continue	Yes	Resume stopped process
SIGTTIN	21	Stop	Yes	Background read from terminal
SIGTTOU	22	Stop	Yes	Background write to terminal
SIGCHLD	17	Ignore	Yes	Child process status changed

Zombie Prevention

To prevent zombie children: either (1) call wait()/waitpid() periodically, (2) install SIGCHLD handler that calls waitpid() with WNOHANG in a loop, or (3) set SIGCHLD disposition to SIG_IGN (on systems that support this—children are auto-reaped). The third option is simplest but loses exit status information.

Timer and Alarm Signals

Timer signals provide a mechanism for time-based notifications. They're used for implementing timeouts, periodic tasks, and monitoring resource consumption.

SIGALRM (Signal 14): Alarm Clock

Default action: Terminate

SIGALRM is delivered when a timer set by alarm() or the ITIMER_REAL interval timer expires. It measures real (wall-clock) time.

Use cases:

Implementing timeouts for blocking operations
Periodic polling or heartbeat logic
Watchdog mechanisms

alarm_timeout.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <setjmp.h>
 
static sigjmp_buf timeout_jmp;
volatile sig_atomic_t timed_out = 0;
 
void alarm_handler(int sig) {
    timed_out = 1;
    siglongjmp(timeout_jmp, 1);
}
 
/*
 * Read with timeout using SIGALRM.
 * Returns: bytes read, 0 on timeout, -1 on error.
 */
ssize_t read_with_timeout(int fd, void *buf, size_t count, unsigned int seconds) {
    struct sigaction sa, old_sa;
    ssize_t result;
    
    timed_out = 0;
    
    /* Install alarm handler */
    sa.sa_handler = alarm_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = 0;  /* No SA_RESTART - we want EINTR */
    sigaction(SIGALRM, &sa, &old_sa);
    
    if (sigsetjmp(timeout_jmp, 1) == 0) {
        /* Normal path */
        alarm(seconds);
        result = read(fd, buf, count);
        alarm(0);  /* Cancel alarm */
    } else {
        /* Returned via longjmp from alarm handler */
        result = 0;  /* Indicate timeout */
    }
    
    /* Restore original handler */
    sigaction(SIGALRM, &old_sa, NULL);
    
    return result;
}
 
int main() {
    char buffer[256];
    
    printf("Enter input within 5 seconds: ");
    fflush(stdout);
    
    ssize_t bytes = read_with_timeout(STDIN_FILENO, buffer, sizeof(buffer) - 1, 5);
    
    if (bytes > 0) {
        buffer[bytes] = '\0';
        printf("You entered: %s", buffer);
    } else if (timed_out) {
        printf("
Timeout! No input received.
");
    } else {
        perror("read");
    }
    
    return 0;
}

SIGVTALRM (Signal 26): Virtual Timer Alarm

Default action: Terminate

SIGVTALRM measures virtual time—only the time the process spends in user-mode execution. Time spent blocked or in kernel mode doesn't count. Used for profiling CPU-intensive code.

struct itimerval timer;
timer.it_value.tv_sec = 1;        /* First alarm in 1 second of CPU time */
timer.it_value.tv_usec = 0;
timer.it_interval.tv_sec = 0;     /* No repeat */
timer.it_interval.tv_usec = 0;
setitimer(ITIMER_VIRTUAL, &timer, NULL);

SIGPROF (Signal 27): Profiling Timer Alarm

Default action: Terminate

SIGPROF measures profiling time—user plus kernel time spent executing on behalf of the process. More comprehensive than SIGVTALRM for profiling because it includes system calls.

Comparison of Timer Types

Timer	Signal	Measures	Use Case
ITIMER_REAL	SIGALRM	Wall-clock time	Timeouts, scheduling
ITIMER_VIRTUAL	SIGVTALRM	User CPU time	User-mode profiling
ITIMER_PROF	SIGPROF	User + Kernel time	Full CPU profiling

Modern Alternatives: timerfd and POSIX Timers

The classic alarm() and setitimer() interfaces have limitations:

Only one timer per type per process
Signal-based notification has async complexities

Modern Linux provides better alternatives:

timerfd (timerfd_create, timerfd_settime):

Timers as file descriptors
Integrate with select(), poll(), epoll()
Multiple independent timers
No signal handling required

POSIX Timers (timer_create, timer_settime):

Multiple timers with independent clocks
Can notify via signal OR thread
Per-thread notifications for multi-threaded programs

Modern Timer Recommendation

For new code, prefer timerfd (Linux) or kqueue (BSD/macOS) over signal-based timers. File-descriptor-based timers integrate cleanly with event loops, avoid signal handler complexity, and scale to many timers. Use SIGALRM only for simple timeout scenarios or legacy compatibility.

I/O and Pipe Signals

Several signals relate to I/O operations, particularly pipes and sockets. These signals simplify error handling in process communication.

SIGPIPE (Signal 13): Broken Pipe

Default action: Terminate

SIGPIPE is delivered when a process writes to a pipe (or socket) with no readers. Without this signal, writes would fail with EPIPE, but the process might not notice until later. SIGPIPE provides immediate notification.

The problem: Default termination is often undesirable. A web server shouldn't crash just because a client disconnected mid-response.

Solutions:

Ignore SIGPIPE globally: signal(SIGPIPE, SIG_IGN) then handle EPIPE on write
Use send() with MSG_NOSIGNAL flag (socket-specific)
Set SO_NOSIGPIPE socket option (BSD/macOS)

Most production network servers ignore SIGPIPE.

sigpipe_handling.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
 
/*
 * Demonstrates proper SIGPIPE handling for network/pipe code.
 * Ignore SIGPIPE and handle EPIPE explicitly.
 */
 
ssize_t safe_write(int fd, const void *buf, size_t count) {
    ssize_t result;
    
    result = write(fd, buf, count);
    
    if (result == -1) {
        if (errno == EPIPE) {
            /* Peer closed connection - handle gracefully */
            fprintf(stderr, "Warning: write to closed pipe/socket
");
            return -1;
        }
        /* Other errors */
        perror("write");
        return -1;
    }
    
    return result;
}
 
int main() {
    int pipefd[2];
    
    /* 
     * CRITICAL: Ignore SIGPIPE globally for any process doing 
     * network or pipe I/O where peer may disconnect.
     */
    signal(SIGPIPE, SIG_IGN);
    
    if (pipe(pipefd) == -1) {
        perror("pipe");
        exit(1);
    }
    
    /* Close read end - creates "broken pipe" condition */
    close(pipefd[0]);
    
    /* Without SIG_IGN, this would terminate the process */
    const char *msg = "Hello, broken pipe!";
    ssize_t written = safe_write(pipefd[1], msg, strlen(msg));
    
    if (written == -1) {
        printf("Write failed as expected (EPIPE), but process survived!
");
    }
    
    close(pipefd[1]);
    return 0;
}

SIGIO (Signal 29): I/O Possible

Default action: Terminate (historically) or Ignore (modern Linux)

SIGIO provides asynchronous I/O notification—"data is available on this file descriptor." To use:

Set O_ASYNC flag on file descriptor
Set process as owner with F_SETOWN
Install SIGIO handler

Caveat: SIGIO is largely obsoleted by select(), poll(), and especially epoll(). These interfaces scale better and don't have signal handling complexity. SIGIO is mainly of historical interest.

SIGURG (Signal 23): Urgent Socket Data

Default action: Ignore

SIGURG indicates out-of-band (OOB) data on a socket. OOB data is rarely used—primarily in telnet for interrupt sequences. Most applications ignore this signal entirely.

SIGPOLL (Signal 29): Pollable Event (System V)

Default action: Terminate

SIGPOLL (same as SIGIO on Linux) is the System V equivalent. It's generated when an event occurs on a file descriptor marked for async notification. Like SIGIO, it's obsoleted by modern multiplexing APIs.

I/O and Pipe Signals
Signal	Number	Default	Condition	Practical Handling
SIGPIPE	13	Terminate	Write to closed pipe/socket	Ignore globally, check EPIPE
SIGIO	29	Ignore	I/O possible on async fd	Use poll/epoll instead
SIGURG	23	Ignore	Out-of-band socket data	Rarely needed, ignore

SIGPIPE is a Design Choice

SIGPIPE exists because pipes were originally used interactively (shell pipelines). If you run cat file | head -1, head exits after one line, and SIGPIPE terminates cat immediately—efficient, no wasted work. But for network servers, this behavior is counterproductive. Always ignore SIGPIPE in daemons and network code.

User-Defined and Miscellaneous Signals

POSIX reserves specific signals for application-defined purposes and provides additional signals for special conditions.

SIGUSR1 and SIGUSR2 (Signals 10, 12): User-Defined Signals

Default action: Terminate

These signals have no predefined meaning—applications define their semantics. Common uses:

Log rotation: SIGUSR1 tells daemon to reopen log files
Debug toggling: SIGUSR2 enables/disables verbose logging
Statistics dump: SIGUSR1 causes server to print internal stats
Config reload: Alternative to SIGHUP

# Common patterns in production
kill -USR1 $(cat /var/run/nginx.pid)   # Reopen logs
kill -USR2 $(cat /var/run/app.pid)     # Dump stats

SIGWINCH (Signal 28): Window Size Change

Default action: Ignore

SIGWINCH is sent when terminal window dimensions change. Interactive programs (vim, less, htop) handle this to redraw their interface. Non-interactive programs ignore it.

SIGXCPU and SIGXFSZ (Signals 24, 25): Resource Limits

Default action: Terminate (+core for SIGXCPU)

SIGXCPU: CPU time limit exceeded (from setrlimit(RLIMIT_CPU, ...))
SIGXFSZ: File size limit exceeded (from setrlimit(RLIMIT_FSIZE, ...))

These signals enforce resource quotas set by the process or administrator.

SIGPWR (Signal 30): Power Failure

Default action: Terminate

Historically sent when UPS signals imminent power loss. Rarely seen on modern systems with proper power management.

SIGSTKFLT (Signal 16): Stack Fault (Linux)

Default action: Terminate

Historically used for math coprocessor stack faults. Obsolete on modern hardware.

Real-Time Signals (SIGRTMIN to SIGRTMAX)

As discussed previously, real-time signals (typically 34-64 on Linux) offer:

Guaranteed queuing (each occurrence delivered)
Defined delivery order (lower numbers first)
Data payload via sigqueue()

They're user-definable like SIGUSR1/2 but with richer semantics.

sigusr_example.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#include <signal.h>
#include <stdio.h>
#include <unistd.h>
 
volatile sig_atomic_t debug_mode = 0;
volatile sig_atomic_t stats_requested = 0;
 
void sigusr1_handler(int sig) {
    stats_requested = 1;
}
 
void sigusr2_handler(int sig) {
    debug_mode = !debug_mode;  /* Toggle debug mode */
}
 
void print_stats() {
    printf("
=== Application Statistics ===
");
    printf("Debug mode: %s
", debug_mode ? "ON" : "OFF");
    printf("Uptime: (would show uptime)
");
    printf("Requests handled: (would show count)
");
    printf("==============================
 
");
}
 
int main() {
    struct sigaction sa1, sa2;
    
    sa1.sa_handler = sigusr1_handler;
    sigemptyset(&sa1.sa_mask);
    sa1.sa_flags = SA_RESTART;
    sigaction(SIGUSR1, &sa1, NULL);
    
    sa2.sa_handler = sigusr2_handler;
    sigemptyset(&sa2.sa_mask);
    sa2.sa_flags = SA_RESTART;
    sigaction(SIGUSR2, &sa2, NULL);
    
    printf("Daemon started (PID %d)
", getpid());
    printf("  SIGUSR1: Print stats
");
    printf("  SIGUSR2: Toggle debug mode
");
    
    while (1) {
        if (stats_requested) {
            stats_requested = 0;
            print_stats();
        }
        
        if (debug_mode) {
            printf("[DEBUG] Worker loop iteration
");
        }
        
        sleep(2);  /* Simulate work */
    }
    
    return 0;
}
 
/* 
 * Usage:
 * ./daemon &
 * kill -USR1 $(pgrep daemon)   # Print stats
 * kill -USR2 $(pgrep daemon)   # Toggle debug
 */

Signal Conventions in Production

Document your signal usage! Users of your daemon should know what SIGUSR1/2 do. Popular conventions: SIGUSR1 for log reopen (works with logrotate), SIGHUP for config reload, SIGUSR2 for debug dump. Real-time signals offer more options if you need many distinct notifications.

Complete Signal Reference

For quick reference, here's a comprehensive table of standard POSIX signals. Signal numbers may vary by platform—use symbolic names (SIGTERM, not 15) in code.

Standard POSIX Signals (Linux x86-64)
Signal		Default Action	Description
SIGHUP	1	Terminate	Hangup / reload config
SIGINT	2	Terminate	Interrupt (Ctrl+C)
SIGQUIT	3	Core dump	Quit (Ctrl+\)
SIGILL	4	Core dump	Illegal instruction
SIGTRAP	5	Core dump	Trace/breakpoint trap
SIGABRT	6	Core dump	Abort (from abort())
SIGBUS	7	Core dump	Bus error
SIGFPE	8	Core dump	Floating-point exception
SIGKILL	9	Terminate	Kill (uncatchable)
SIGUSR1	10	Terminate	User-defined 1
SIGSEGV	11	Core dump	Segmentation fault
SIGUSR2	12	Terminate	User-defined 2
SIGPIPE	13	Terminate	Broken pipe
SIGALRM	14	Terminate	Alarm clock
SIGTERM	15	Terminate	Termination request
SIGSTKFLT	16	Terminate	Stack fault (obsolete)
SIGCHLD	17	Ignore	Child status changed
SIGCONT	18	Continue	Continue if stopped
SIGSTOP	19	Stop	Stop (uncatchable)
SIGTSTP	20	Stop	Terminal stop (Ctrl+Z)
SIGTTIN	21	Stop	Background read
SIGTTOU	22	Stop	Background write
SIGURG	23	Ignore	Urgent socket data
SIGXCPU	24	Core dump	CPU time limit
SIGXFSZ	25	Core dump	File size limit
SIGVTALRM	26	Terminate	Virtual timer
SIGPROF	27	Terminate	Profiling timer
SIGWINCH	28	Ignore	Window size change
SIGIO	29	Terminate	I/O possible
SIGPWR	30	Terminate	Power failure
SIGSYS	31	Core dump	Bad system call

Platform Variations

Signal numbers differ between platforms! SIGUSR1 is 10 on Linux but 30 on macOS. SIGBUS is 7 on Linux but 10 on macOS. Always use symbolic names in code and check with kill -l on your target platform.

Summary: Common Signals

Understanding the vocabulary of signals is essential for UNIX systems programming. Let's consolidate the key categories and practices:

Key Takeaways

•Termination signals have hierarchy — SIGTERM (graceful) → SIGINT (interactive) → SIGKILL (forced). Always try graceful first.
•Error signals indicate bugs — SIGSEGV, SIGFPE, SIGBUS, SIGILL usually mean your code is broken. Log diagnostics, then terminate.
•Job control signals manage lifecycle — SIGSTOP/SIGCONT, SIGTSTP for interactive control, SIGCHLD for parent notification.
•Timer signals enable timeouts — SIGALRM for wall-clock, SIGVTALRM for CPU time. Consider timerfd for modern code.
•SIGPIPE should be ignored in network code — Prevents crashes on client disconnect; handle EPIPE instead.
•SIGUSR1/SIGUSR2 are application-defined — Document your conventions (log rotation, debug toggle, stats dump).
•Use symbolic names, not numbers — Signal numbers vary by platform; SIGTERM is portable, 15 is not.
•SIGKILL and SIGSTOP cannot be caught — The kernel guarantees these work; use them as last resort for termination/suspension.

What's Next:

Now that you know the signal vocabulary, the next page covers signal handlers—how to install them properly, what you can safely do inside them, and how to avoid the subtle bugs that plague signal-handling code.

Page Complete: Common Signals

You now have a working vocabulary of UNIX/POSIX signals. You can identify signals in error messages, choose appropriate signals for process management, and understand system behavior in failure scenarios. Next, we'll learn how to handle these signals correctly.

Common Signals: The UNIX Signal Vocabulary

Learning the Signal Language

Just as a doctor must know the names and functions of human organs, a systems programmer must know the names and purposes of standard signals. This knowledge enables you to:

Interpret log messages and crash reports correctly
Choose appropriate signals for process management
Implement handlers for signals that matter to your application
Understand system behavior in failure scenarios

This page catalogs the signals you'll encounter most frequently, explaining not just what they are but when you'll see them and why they exist.

What You Will Learn

Process Termination Signals

The most common use of signals is to terminate processes—gracefully or forcefully. Understanding the hierarchy of termination signals is essential for proper process management.

SIGTERM (Signal 15): The Polite Termination Request

Default action: Terminate

SIGTERM is the "gentleman's request" to terminate. It says: "Please shut down cleanly at your earliest convenience." Key characteristics:

Catchable and ignorable: Processes can install handlers to perform cleanup
Default signal for kill command: Running kill <pid> sends SIGTERM by default
Industry convention: Well-behaved daemons should terminate gracefully on SIGTERM

Best practice: Always handle SIGTERM for long-running processes. Your handler should:

Stop accepting new work
Complete in-progress work (if quick) or cancel cleanly
Release resources (close files, flush buffers, release locks)
Exit with appropriate status code

graceful_shutdown.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
 
volatile sig_atomic_t shutdown_requested = 0;
 
void sigterm_handler(int sig) {
    shutdown_requested = 1;
    /* 
     * Do NOT call printf, malloc, exit, or other non-async-signal-safe
     * functions here. Only set flags and let main loop handle cleanup.
     */
}
 
void cleanup() {
    printf("Performing graceful shutdown...
");
    /* Flush buffers, close connections, release locks */
    printf("Cleanup complete. Exiting.
");
}
 
int main() {
    struct sigaction sa;
    
    sa.sa_handler = sigterm_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = 0;
    
    sigaction(SIGTERM, &sa, NULL);
    sigaction(SIGINT, &sa, NULL);  /* Also handle Ctrl+C gracefully */
    
    printf("Server running (PID %d). Send SIGTERM to shutdown gracefully.
", getpid());
    
    /* Main work loop */
    while (!shutdown_requested) {
        printf("Working...
");
        sleep(2);  /* Simulate work */
    }
    
    cleanup();
    return 0;
}

SIGKILL (Signal 9): The Guaranteed Terminator

Default action: Terminate (cannot be caught, blocked, or ignored)

SIGKILL is the nuclear option. The kernel terminates the process immediately—no handler runs, no cleanup occurs. Use cases:

Terminating processes that ignore SIGTERM
Emergency resource reclamation
System shutdown procedures

Warning: SIGKILL should be a last resort. Using it routinely causes:

Corrupted files from unflushed writes
Orphaned resources (shared memory, temporary files)
Broken database transactions
Unnotified dependent services

Convention: Send SIGTERM first, wait a grace period (e.g., 10 seconds), then SIGKILL if necessary.

SIGINT (Signal 2): Interactive Interrupt

Default action: Terminate

SIGINT is generated by Ctrl+C in the terminal. It's intended for interactive interrupt—user wants to stop what's happening NOW. Characteristics:

Sent to entire foreground process group
Catchable—handlers can perform quick cleanup
Conventional meaning: "User wants out of current operation"

Handler strategy: SIGINT handlers should be quick. The user is waiting. If cleanup is lengthy, acknowledge receipt immediately and timeout if needed.

SIGQUIT (Signal 3): Quit with Core Dump

Default action: Terminate + core dump

SIGHUP (Signal 1): Hangup

Default action: Terminate

SIGHUP originally meant "terminal hung up" (modem disconnected). Modern uses:

Terminal close notification: Sent to foreground process group when terminal closes
Configuration reload convention: Daemons often reread configuration on SIGHUP instead of terminating

# Common daemon pattern: reload config without restart
kill -HUP $(cat /var/run/nginx.pid)

This dual meaning (terminate vs. reload) depends on context—daemons that detach from terminals typically interpret SIGHUP as reload.

Termination Signals Summary
Signal	Number	Default	Generated By	Typical Use
SIGTERM	15	Terminate	`kill <pid>`, system shutdown	Graceful termination request
SIGKILL	9	Terminate	`kill -9 <pid>`	Forced termination (last resort)
SIGINT	2	Terminate	Ctrl+C	Interactive interrupt
SIGQUIT	3	Terminate + core	Ctrl+\	Debug termination
SIGHUP	1	Terminate	Terminal close, shell logout	Reload config (daemons)

Production Best Practice

Error and Exception Signals

SIGSEGV (Signal 11): Segmentation Violation

Default action: Terminate + core dump

SIGSEGV is the most famous (infamous?) signal—the dreaded "segmentation fault." It indicates invalid memory access:

Dereferencing NULL or wild pointers
Accessing memory beyond array bounds
Writing to read-only memory (text segment, const data)
Stack overflow from deep recursion

Can you catch SIGSEGV? Technically yes, but recovery is difficult:

The process state is corrupt—you don't know what else is damaged
Returning from handler normally re-executes the faulting instruction (infinite loop)
Jumping elsewhere (via siglongjmp) may work but leaves state unclear

Practical approach: Install SIGSEGV handler for logging/diagnostics only, then terminate. Use address sanitizers (ASan) during development to catch these bugs early.

sigsegv_diagnostic.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <execinfo.h>  /* For backtrace - Linux/glibc */
 
void sigsegv_handler(int sig, siginfo_t *info, void *context) {
    void *array[50];
    int size;
    
    fprintf(stderr, "
=== SEGMENTATION FAULT ===
");
    fprintf(stderr, "Signal: %d
", sig);
    fprintf(stderr, "Fault address: %p
", info->si_addr);
    fprintf(stderr, "
Backtrace:
");
    
    /* Get backtrace - note: not async-signal-safe, but we're crashing anyway */
    size = backtrace(array, 50);
    backtrace_symbols_fd(array, size, STDERR_FILENO);
    
    fprintf(stderr, "
Core dump will be generated if enabled.
");
    
    /* 
     * Re-raise with default handler to generate core dump.
     * This is the recommended pattern for diagnostic handlers.
     */
    signal(SIGSEGV, SIG_DFL);
    raise(SIGSEGV);
}
 
int main() {
    struct sigaction sa;
    
    sa.sa_sigaction = sigsegv_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_SIGINFO;  /* Use sa_sigaction, not sa_handler */
    sigaction(SIGSEGV, &sa, NULL);
    
    /* Trigger SIGSEGV */
    int *ptr = NULL;
    *ptr = 42;  /* Crash here */
    
    return 0;
}
 
/*
 * Compile: gcc -rdynamic sigsegv_diagnostic.c -o segv_demo
 * The -rdynamic flag includes symbol names in backtrace.
 */

SIGFPE (Signal 8): Floating-Point Exception

Default action: Terminate + core dump

Despite the name, SIGFPE covers all arithmetic exceptions, not just floating-point:

Integer division by zero
Integer overflow (on some architectures)
Floating-point divide by zero (if FPE traps enabled)
Floating-point overflow/underflow (if traps enabled)
Invalid floating-point operation (e.g., sqrt of negative)

Note: By default, IEEE 754 floating-point operations do NOT raise SIGFPE—they produce special values (Inf, NaN). SIGFPE for FP requires enabling traps via feenableexcept() (Linux/glibc).

SIGBUS (Signal 7): Bus Error

Default action: Terminate + core dump

SIGBUS indicates a bus error—hardware-level memory access problem:

Misaligned memory access (on architectures that require alignment)
Accessing memory-mapped file beyond file size (after mmap)
Non-existent physical address (rare on modern systems with MMU)

Difference from SIGSEGV: SIGSEGV = valid address, no permission. SIGBUS = physical access failure.

SIGILL (Signal 4): Illegal Instruction

Default action: Terminate + core dump

SIGILL indicates the CPU encountered an instruction it cannot execute:

Corrupted executable code (binary manipulation, buffer overflow)
Executing code compiled for different architecture (e.g., AVX on non-AVX CPU)
JIT compilation bugs generating invalid opcodes
Hardware failure corrupting instruction fetch

This signal is rare in normal operation—it usually indicates severe corruption or hacking attempts.

SIGABRT (Signal 6): Abort

Default action: Terminate + core dump

SIGABRT is generated programmatically when a process calls abort(). Uses:

assert() failure—the assertion macro calls abort()
C library internal errors (e.g., double-free detected by malloc)
Explicit program abort for unrecoverable errors

Unlike hardware exception signals, SIGABRT is intentional—the program is saying "I detected something wrong and cannot continue."

Error and Exception Signals
Signal	Number	Cause	Common Triggering Bugs
SIGSEGV	11	Invalid memory access	NULL dereference, buffer overflow, stack overflow
SIGFPE	8	Arithmetic exception	Division by zero, integer overflow
SIGBUS	7	Bus/alignment error	Misaligned access, mmap beyond EOF
SIGILL	4	Illegal instruction	Binary corruption, wrong architecture
SIGABRT	6	Abort called	assert() failure, double-free
SIGTRAP	5	Trace/breakpoint trap	Debugger breakpoint, debug trap instruction
SIGSYS	31	Bad system call	Invalid syscall number, seccomp violation

Exit Codes and Signal Numbers

Job Control Signals

SIGSTOP (Signal 19): Stop Process

Default action: Stop (cannot be caught, blocked, or ignored)

Use cases:

Debugging: Stop a process for examination
Resource management: Pause low-priority work during peaks
System tools: kill -STOP <pid> to freeze a process

SIGTSTP (Signal 20): Terminal Stop

Default action: Stop

SIGTSTP is the catchable version of SIGSTOP, generated by Ctrl+Z. Unlike SIGSTOP:

Processes can catch it and perform cleanup before stopping
Handler can ignore the stop request (though this breaks user expectations)

Handler pattern for SIGTSTP:

sigtstp_handler.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#include <signal.h>
#include <stdio.h>
#include <unistd.h>
#include <termios.h>
 
struct termios original_termios;
 
void sigtstp_handler(int sig) {
    /* Restore terminal settings before stopping */
    tcsetattr(STDIN_FILENO, TCSANOW, &original_termios);
    
    /* 
     * To actually stop, we must:
     * 1. Reset SIGTSTP to default handler
     * 2. Raise SIGTSTP to stop ourselves
     * 3. When continued, re-install our handler
     */
    signal(SIGTSTP, SIG_DFL);
    raise(SIGTSTP);  /* Now we actually stop */
    
    /* Execution resumes here after SIGCONT */
    signal(SIGTSTP, sigtstp_handler);  /* Re-install handler */
    
    /* Restore our custom terminal settings */
    /* (would restore custom settings here) */
    printf("
Resumed!
");
}
 
int main() {
    tcgetattr(STDIN_FILENO, &original_termios);
    
    struct sigaction sa;
    sa.sa_handler = sigtstp_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_RESTART;
    sigaction(SIGTSTP, &sa, NULL);
    
    printf("Press Ctrl+Z to suspend...
");
    
    while (1) {
        printf("Working...
");
        sleep(1);
    }
    
    return 0;
}

SIGCONT (Signal 18): Continue Stopped Process

Default action: Continue (if stopped); ignore (if running)

SIGCONT resumes a stopped process. Special characteristics:

Always has effect on stopped processes—even if ignored
If a handler is installed, it runs after the process resumes
Cannot be blocked while process is stopped (would deadlock)

Shell job control:

fg %1      # Bring job 1 to foreground (sends SIGCONT)
bg %1      # Resume job 1 in background (sends SIGCONT)

SIGTTIN and SIGTTOU (Signals 21, 22): Background Terminal I/O

Default action: Stop

These signals prevent background processes from interfering with terminal I/O:

SIGTTIN: Background process tried to read from terminal → stopped
SIGTTOU: Background process tried to write to terminal → stopped (if stty tostop is set)

This prevents confusing scenarios where multiple processes fight for terminal input/output.

SIGCHLD (Signal 17): Child Status Changed

Default action: Ignore

SIGCHLD notifies parent processes when child state changes:

Child terminated (normally or abnormally)
Child stopped (by SIGSTOP or SIGTSTP)
Child resumed (by SIGCONT)

This signal is critical for proper process management. Without handling SIGCHLD properly, terminated children become zombies.

Job Control Signals
Signal	Number	Action	Catchable?	Purpose
SIGSTOP	19	Stop	No	Unconditional stop
SIGTSTP	20	Stop	Yes	Terminal stop (Ctrl+Z)
SIGCONT	18	Continue	Yes	Resume stopped process
SIGTTIN	21	Stop	Yes	Background read from terminal
SIGTTOU	22	Stop	Yes	Background write to terminal
SIGCHLD	17	Ignore	Yes	Child process status changed

Zombie Prevention

Timer and Alarm Signals

Timer signals provide a mechanism for time-based notifications. They're used for implementing timeouts, periodic tasks, and monitoring resource consumption.

SIGALRM (Signal 14): Alarm Clock

Default action: Terminate

SIGALRM is delivered when a timer set by alarm() or the ITIMER_REAL interval timer expires. It measures real (wall-clock) time.

Use cases:

Implementing timeouts for blocking operations
Periodic polling or heartbeat logic
Watchdog mechanisms

alarm_timeout.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <setjmp.h>
 
static sigjmp_buf timeout_jmp;
volatile sig_atomic_t timed_out = 0;
 
void alarm_handler(int sig) {
    timed_out = 1;
    siglongjmp(timeout_jmp, 1);
}
 
/*
 * Read with timeout using SIGALRM.
 * Returns: bytes read, 0 on timeout, -1 on error.
 */
ssize_t read_with_timeout(int fd, void *buf, size_t count, unsigned int seconds) {
    struct sigaction sa, old_sa;
    ssize_t result;
    
    timed_out = 0;
    
    /* Install alarm handler */
    sa.sa_handler = alarm_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = 0;  /* No SA_RESTART - we want EINTR */
    sigaction(SIGALRM, &sa, &old_sa);
    
    if (sigsetjmp(timeout_jmp, 1) == 0) {
        /* Normal path */
        alarm(seconds);
        result = read(fd, buf, count);
        alarm(0);  /* Cancel alarm */
    } else {
        /* Returned via longjmp from alarm handler */
        result = 0;  /* Indicate timeout */
    }
    
    /* Restore original handler */
    sigaction(SIGALRM, &old_sa, NULL);
    
    return result;
}
 
int main() {
    char buffer[256];
    
    printf("Enter input within 5 seconds: ");
    fflush(stdout);
    
    ssize_t bytes = read_with_timeout(STDIN_FILENO, buffer, sizeof(buffer) - 1, 5);
    
    if (bytes > 0) {
        buffer[bytes] = '\0';
        printf("You entered: %s", buffer);
    } else if (timed_out) {
        printf("
Timeout! No input received.
");
    } else {
        perror("read");
    }
    
    return 0;
}

SIGVTALRM (Signal 26): Virtual Timer Alarm

Default action: Terminate

SIGVTALRM measures virtual time—only the time the process spends in user-mode execution. Time spent blocked or in kernel mode doesn't count. Used for profiling CPU-intensive code.

struct itimerval timer;
timer.it_value.tv_sec = 1;        /* First alarm in 1 second of CPU time */
timer.it_value.tv_usec = 0;
timer.it_interval.tv_sec = 0;     /* No repeat */
timer.it_interval.tv_usec = 0;
setitimer(ITIMER_VIRTUAL, &timer, NULL);

SIGPROF (Signal 27): Profiling Timer Alarm

Default action: Terminate

SIGPROF measures profiling time—user plus kernel time spent executing on behalf of the process. More comprehensive than SIGVTALRM for profiling because it includes system calls.

Comparison of Timer Types

Timer	Signal	Measures	Use Case
ITIMER_REAL	SIGALRM	Wall-clock time	Timeouts, scheduling
ITIMER_VIRTUAL	SIGVTALRM	User CPU time	User-mode profiling
ITIMER_PROF	SIGPROF	User + Kernel time	Full CPU profiling

Modern Alternatives: timerfd and POSIX Timers

The classic alarm() and setitimer() interfaces have limitations:

Only one timer per type per process
Signal-based notification has async complexities

Modern Linux provides better alternatives:

timerfd (timerfd_create, timerfd_settime):

Timers as file descriptors
Integrate with select(), poll(), epoll()
Multiple independent timers
No signal handling required

POSIX Timers (timer_create, timer_settime):

Multiple timers with independent clocks
Can notify via signal OR thread
Per-thread notifications for multi-threaded programs

Modern Timer Recommendation

I/O and Pipe Signals

Several signals relate to I/O operations, particularly pipes and sockets. These signals simplify error handling in process communication.

SIGPIPE (Signal 13): Broken Pipe

Default action: Terminate

The problem: Default termination is often undesirable. A web server shouldn't crash just because a client disconnected mid-response.

Solutions:

Ignore SIGPIPE globally: signal(SIGPIPE, SIG_IGN) then handle EPIPE on write
Use send() with MSG_NOSIGNAL flag (socket-specific)
Set SO_NOSIGPIPE socket option (BSD/macOS)

Most production network servers ignore SIGPIPE.

sigpipe_handling.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
 
/*
 * Demonstrates proper SIGPIPE handling for network/pipe code.
 * Ignore SIGPIPE and handle EPIPE explicitly.
 */
 
ssize_t safe_write(int fd, const void *buf, size_t count) {
    ssize_t result;
    
    result = write(fd, buf, count);
    
    if (result == -1) {
        if (errno == EPIPE) {
            /* Peer closed connection - handle gracefully */
            fprintf(stderr, "Warning: write to closed pipe/socket
");
            return -1;
        }
        /* Other errors */
        perror("write");
        return -1;
    }
    
    return result;
}
 
int main() {
    int pipefd[2];
    
    /* 
     * CRITICAL: Ignore SIGPIPE globally for any process doing 
     * network or pipe I/O where peer may disconnect.
     */
    signal(SIGPIPE, SIG_IGN);
    
    if (pipe(pipefd) == -1) {
        perror("pipe");
        exit(1);
    }
    
    /* Close read end - creates "broken pipe" condition */
    close(pipefd[0]);
    
    /* Without SIG_IGN, this would terminate the process */
    const char *msg = "Hello, broken pipe!";
    ssize_t written = safe_write(pipefd[1], msg, strlen(msg));
    
    if (written == -1) {
        printf("Write failed as expected (EPIPE), but process survived!
");
    }
    
    close(pipefd[1]);
    return 0;
}

SIGIO (Signal 29): I/O Possible

Default action: Terminate (historically) or Ignore (modern Linux)

SIGIO provides asynchronous I/O notification—"data is available on this file descriptor." To use:

Set O_ASYNC flag on file descriptor
Set process as owner with F_SETOWN
Install SIGIO handler

SIGURG (Signal 23): Urgent Socket Data

Default action: Ignore

SIGURG indicates out-of-band (OOB) data on a socket. OOB data is rarely used—primarily in telnet for interrupt sequences. Most applications ignore this signal entirely.

SIGPOLL (Signal 29): Pollable Event (System V)

Default action: Terminate

I/O and Pipe Signals
Signal	Number	Default	Condition	Practical Handling
SIGPIPE	13	Terminate	Write to closed pipe/socket	Ignore globally, check EPIPE
SIGIO	29	Ignore	I/O possible on async fd	Use poll/epoll instead
SIGURG	23	Ignore	Out-of-band socket data	Rarely needed, ignore

SIGPIPE is a Design Choice

User-Defined and Miscellaneous Signals

POSIX reserves specific signals for application-defined purposes and provides additional signals for special conditions.

SIGUSR1 and SIGUSR2 (Signals 10, 12): User-Defined Signals

Default action: Terminate

These signals have no predefined meaning—applications define their semantics. Common uses:

Log rotation: SIGUSR1 tells daemon to reopen log files
Debug toggling: SIGUSR2 enables/disables verbose logging
Statistics dump: SIGUSR1 causes server to print internal stats
Config reload: Alternative to SIGHUP

# Common patterns in production
kill -USR1 $(cat /var/run/nginx.pid)   # Reopen logs
kill -USR2 $(cat /var/run/app.pid)     # Dump stats

SIGWINCH (Signal 28): Window Size Change

Default action: Ignore

SIGWINCH is sent when terminal window dimensions change. Interactive programs (vim, less, htop) handle this to redraw their interface. Non-interactive programs ignore it.

SIGXCPU and SIGXFSZ (Signals 24, 25): Resource Limits

Default action: Terminate (+core for SIGXCPU)

SIGXCPU: CPU time limit exceeded (from setrlimit(RLIMIT_CPU, ...))
SIGXFSZ: File size limit exceeded (from setrlimit(RLIMIT_FSIZE, ...))

These signals enforce resource quotas set by the process or administrator.

SIGPWR (Signal 30): Power Failure

Default action: Terminate

Historically sent when UPS signals imminent power loss. Rarely seen on modern systems with proper power management.

SIGSTKFLT (Signal 16): Stack Fault (Linux)

Default action: Terminate

Historically used for math coprocessor stack faults. Obsolete on modern hardware.

Real-Time Signals (SIGRTMIN to SIGRTMAX)

As discussed previously, real-time signals (typically 34-64 on Linux) offer:

Guaranteed queuing (each occurrence delivered)
Defined delivery order (lower numbers first)
Data payload via sigqueue()

They're user-definable like SIGUSR1/2 but with richer semantics.

sigusr_example.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#include <signal.h>
#include <stdio.h>
#include <unistd.h>
 
volatile sig_atomic_t debug_mode = 0;
volatile sig_atomic_t stats_requested = 0;
 
void sigusr1_handler(int sig) {
    stats_requested = 1;
}
 
void sigusr2_handler(int sig) {
    debug_mode = !debug_mode;  /* Toggle debug mode */
}
 
void print_stats() {
    printf("
=== Application Statistics ===
");
    printf("Debug mode: %s
", debug_mode ? "ON" : "OFF");
    printf("Uptime: (would show uptime)
");
    printf("Requests handled: (would show count)
");
    printf("==============================
 
");
}
 
int main() {
    struct sigaction sa1, sa2;
    
    sa1.sa_handler = sigusr1_handler;
    sigemptyset(&sa1.sa_mask);
    sa1.sa_flags = SA_RESTART;
    sigaction(SIGUSR1, &sa1, NULL);
    
    sa2.sa_handler = sigusr2_handler;
    sigemptyset(&sa2.sa_mask);
    sa2.sa_flags = SA_RESTART;
    sigaction(SIGUSR2, &sa2, NULL);
    
    printf("Daemon started (PID %d)
", getpid());
    printf("  SIGUSR1: Print stats
");
    printf("  SIGUSR2: Toggle debug mode
");
    
    while (1) {
        if (stats_requested) {
            stats_requested = 0;
            print_stats();
        }
        
        if (debug_mode) {
            printf("[DEBUG] Worker loop iteration
");
        }
        
        sleep(2);  /* Simulate work */
    }
    
    return 0;
}
 
/* 
 * Usage:
 * ./daemon &
 * kill -USR1 $(pgrep daemon)   # Print stats
 * kill -USR2 $(pgrep daemon)   # Toggle debug
 */

Signal Conventions in Production

Complete Signal Reference

For quick reference, here's a comprehensive table of standard POSIX signals. Signal numbers may vary by platform—use symbolic names (SIGTERM, not 15) in code.

Standard POSIX Signals (Linux x86-64)
Signal		Default Action	Description
SIGHUP	1	Terminate	Hangup / reload config
SIGINT	2	Terminate	Interrupt (Ctrl+C)
SIGQUIT	3	Core dump	Quit (Ctrl+\)
SIGILL	4	Core dump	Illegal instruction
SIGTRAP	5	Core dump	Trace/breakpoint trap
SIGABRT	6	Core dump	Abort (from abort())
SIGBUS	7	Core dump	Bus error
SIGFPE	8	Core dump	Floating-point exception
SIGKILL	9	Terminate	Kill (uncatchable)
SIGUSR1	10	Terminate	User-defined 1
SIGSEGV	11	Core dump	Segmentation fault
SIGUSR2	12	Terminate	User-defined 2
SIGPIPE	13	Terminate	Broken pipe
SIGALRM	14	Terminate	Alarm clock
SIGTERM	15	Terminate	Termination request
SIGSTKFLT	16	Terminate	Stack fault (obsolete)
SIGCHLD	17	Ignore	Child status changed
SIGCONT	18	Continue	Continue if stopped
SIGSTOP	19	Stop	Stop (uncatchable)
SIGTSTP	20	Stop	Terminal stop (Ctrl+Z)
SIGTTIN	21	Stop	Background read
SIGTTOU	22	Stop	Background write
SIGURG	23	Ignore	Urgent socket data
SIGXCPU	24	Core dump	CPU time limit
SIGXFSZ	25	Core dump	File size limit
SIGVTALRM	26	Terminate	Virtual timer
SIGPROF	27	Terminate	Profiling timer
SIGWINCH	28	Ignore	Window size change
SIGIO	29	Terminate	I/O possible
SIGPWR	30	Terminate	Power failure
SIGSYS	31	Core dump	Bad system call

Platform Variations

Summary: Common Signals

Understanding the vocabulary of signals is essential for UNIX systems programming. Let's consolidate the key categories and practices:

Key Takeaways

•Termination signals have hierarchy — SIGTERM (graceful) → SIGINT (interactive) → SIGKILL (forced). Always try graceful first.
•Error signals indicate bugs — SIGSEGV, SIGFPE, SIGBUS, SIGILL usually mean your code is broken. Log diagnostics, then terminate.
•Job control signals manage lifecycle — SIGSTOP/SIGCONT, SIGTSTP for interactive control, SIGCHLD for parent notification.
•Timer signals enable timeouts — SIGALRM for wall-clock, SIGVTALRM for CPU time. Consider timerfd for modern code.
•SIGPIPE should be ignored in network code — Prevents crashes on client disconnect; handle EPIPE instead.
•SIGUSR1/SIGUSR2 are application-defined — Document your conventions (log rotation, debug toggle, stats dump).
•Use symbolic names, not numbers — Signal numbers vary by platform; SIGTERM is portable, 15 is not.
•SIGKILL and SIGSTOP cannot be caught — The kernel guarantees these work; use them as last resort for termination/suspension.

What's Next:

Page Complete: Common Signals