« Back to Processes

Linux process signals and their meaning

Linux uses signals to interact and define the state of a process. It uses POSIX reliable and real-time signals. The first are considered standard signals.

Many programs are build using glibc and therefore use functions like kill(2) to send a signal to a process or processes group, or even all processes on the system. A process can decide to ignore a signal or take an action after it is received by a signal handler, a routine to catch incoming signals.

Signal list

Signal nameNumeric valueDescription
SIGHUP1Signal to tell user’s terminal is disconnected. For some processes it reloads configuration
SIGINT2Interrupt, for example when using CTRL+C, usually with proper clean up of system resources, such as temporary files
SIGQUIT3Like SIGINT, but usually with CTRL+, often not doing clean up of resources
SIGILL4Illegal instruction, process performs garbage execution or privileged instruction
SIGTRAP5Signal used by debuggers
SIGABRT6Process called abort() function, deliberate crash
SIGIOT6Generated by PDP-11 “iot” instruction, on Linux SIGABRT is used
SIGBUS7Like SIGSEGV, but when trying to use invalid memory address
SIGEMT-Emulator trap, received when performing certain unimplemented instructions
SIGFPE8Floating-point exception, but also occurs with fatal arithmetic errors like division by zero or overflow
SIGKILL9Forced stop of a process, more forceful than SIGTERM
SIGUSR110Reserved for a developer to use and define a relevant action
SIGSEGV11Segmentation fault or access violation, usually when incorrect memory location is attempted to access.
SIGUSR212Similar to SIGUSR1, second reserved signal
SIGPIPE13Broken pipe, related to pipes and FIFO special files
SIGALRM14Expiration of timer that measures real or clock time, used by function like alarm()
SIGTERM15Tell process to stop
SIGSTKFLT16Stack fault, sent to process when a stack overflow or stack underflow occurs
SIGCHLD17Signal sent to parent process when child process is stopped
SIGCLD-Obsolete, replaced by SIGCHLD
SIGSTOP19Stop a process, can not be handled nor ignored by a process
SIGTSTP20Interactive stop request, can be ignored by a process
SIGTTIN21Signal to instruct that reading from terminal is not possible, for example for tasks running in background
SIGTTOU22Same as SIGTTOU, but for writing output to terminal
SIGURG23Urgent signal for out-of-band data, special handling
SIGXCPU24CPU time limit exceeded
SIGXFSZ25File size limit exceeded, such as a defined soft limit
SIGVTALRM26Short for virtual time alarm, expiration of timer that measures CPU time by the current process
SIGPROF27Used for code profiling, CPU time used by process and CPU time expended on behalf of process by the system itself
SIGWINCH28Signal used for events related to resizing of window
SIGIO29Signal to inform when a file descriptor is ready, for example to perform input or output
SIGPOLL-System V signal, very similar to SIGIO
SIGPWR30Signal only used by init process, typically due to hardware issue
SIGINFO-Information request, may let the process share some information such as its status
SIGLOST-Resource lost, such as a lock on NFS resource
SIGSYS31Bad argument provided to a system call (syscall)


Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution!

Mastodon icon