6.4 Signals, kill, Job Control, nohup, screen & tmux (103.5)

6.4 Process Signals, kill, pkill & killall

Quick Summary: In Linux, signals are asynchronous software interrupts transmitted by the kernel or processes to notify a target process of an event. Administrators manage process execution and service lifecycles using kill, pkill, and killall to send signals such as SIGHUP (1, reload configuration), SIGTERM (15, graceful termination), and SIGKILL (9, unconditional kernel termination). Shell job control (Ctrl+Z, bg, fg, jobs) enables multi-tasking within a single terminal session, while nohup and disown protect long-running tasks from disconnection hangup signals.

---

1. POSIX Signal Architecture & Key Signal Numbers

When a signal is delivered to a process, the process performs one of four actions depending on the signal type and registered handlers:

1. Default Action: Executes the kernel's default handler (typically terminate, terminate with core dump, ignore, or pause).
2. Catch & Handle: Invokes a custom signal handler function within the application code (e.g., closing file descriptors, flushing database buffers, or reloading configuration files).
3. Ignore: Drops the signal without taking action.
4. Kernel Override: Handled directly by kernel space; user-space processes cannot intercept or alter this behavior.

The Authoritative LPIC-1 Signals Reference Table

⚠️ LPIC-1 Trap — The Two Uncatchable Signals: SIGKILL (9) and SIGSTOP (19) are the only two signals that can NEVER be caught, blocked, or ignored by any process. The kernel intercepts them and acts unconditionally.

---

2. Process Termination Commands: kill, pkill, killall

1. The kill Command

The kill utility sends a specified signal to one or more processes identified by their numeric PIDs. If no signal is explicitly specified, kill sends SIGTERM (15) by default.

# Sending the default graceful SIGTERM (15) to PID 3102:
$ kill 3102

# Sending SIGKILL (9) using signal number:
$ kill -9 3102

# Sending signals using symbolic names (with or without 'SIG' prefix):
$ kill -SIGKILL 3102
$ kill -KILL 3102
$ kill -s KILL 3102

# Sending SIGHUP (1) to reload configuration:
$ kill -1 1042
$ kill -HUP 1042

Listing Signal Names and Numbers: kill -l

$ kill -l
 1) SIGHUP       2) SIGINT       3) SIGQUIT      4) SIGILL
 5) SIGTRAP      6) SIGABRT      7) SIGBUS       8) SIGFPE
 9) SIGKILL     10) SIGUSR1     11) SIGSEGV     12) SIGUSR2
13) SIGPIPE     14) SIGALRM     15) SIGTERM     ... 64) SIGRTMAX

# Translate a number to signal name:
$ kill -l 9
KILL

# Translate a name to signal number:
$ kill -l KILL
9

2. The pkill Command

pkill sends signals to processes matching a regular expression pattern or specific process attributes, eliminating the need to look up PIDs manually:

# Send SIGHUP to all processes named 'nginx'
$ sudo pkill -HUP nginx

# Force kill all processes owned by user 'testuser':
$ sudo pkill -9 -u testuser

# Kill process matching full command line string:
$ pkill -f "python3 /opt/worker.py"

3. The killall Command

killall sends signals to processes by their exact executable name:

# Terminate all instances of the Apache web server:
$ sudo killall httpd

# Force kill with interactive confirmation for each process:
$ killall -i -9 firefox
Kill firefox(2841)? (y/n) y
Kill firefox(2842)? (y/n) n

# Target processes owned by a specific user:
$ sudo killall -u alice php-fpm

# Wait until all killed processes have terminated before exiting:
$ sudo killall -w nginx

---

3. Bash Job Control Mechanics

Job control is a feature of the shell that allows a single terminal window to run and manage multiple concurrent tasks.

Running Tasks in the Background (&)

Appending an ampersand (&) to any command instructs the shell to execute it asynchronously in the background, immediately returning the shell prompt:

$ tar -czf /backup/large_data.tar.gz /srv/data &
[1] 4912
# [1] = Job Number
# 4912 = Process ID (PID)

Suspending and Resuming Jobs

Job Control State Machine Flow:
 ┌────────────────────────────────────────────────────────┐
 │ Foreground Process (Running actively on terminal)      │
 └───────────────────────────┬────────────────────────────┘
                             │ Keystroke: Ctrl+Z (SIGTSTP / 20)
                             ▼
 ┌────────────────────────────────────────────────────────┐
 │ Stopped Job (Suspended in memory, State: T)            │
 └──────────────┬──────────────────────────┬──────────────┘
                │ Command: `bg %1`         │ Command: `fg %1`
                ▼                          ▼
 ┌───────────────────────────┐  ┌─────────────────────────┐
 │ Background Running Job    │  │ Foreground Running Job  │
 │ (Runs detached, State: S) │  │ (Reclaims Terminal)     │
 └───────────────────────────┘  └─────────────────────────┘

Managing Jobs with jobs

$ jobs -l
[1]-  4912 Running                 sleep 300 &
[2]+  4950 Stopped                 vim /etc/hosts

• [N] (Job ID): The sequential job number within the current shell.
• + (Current Job): The default target job for fg or bg if no job ID is specified (can be referenced as %+ or %%).
• - (Previous Job): The secondary default job (referenced as %-).
• -l flag: Displays Process IDs (PIDs) alongside job numbers.
• -r flag: Lists only running background jobs.
• -s flag: Lists only stopped jobs.

Job Control Commands

• fg %N: Brings background or stopped job N to the foreground.
• bg %N: Resumes stopped job N to continue executing in the background (sends SIGCONT).
• kill %N: Sends a signal to job number N using the % job prefix notation.

---

4. Immune Execution: nohup and disown

When a user closes an SSH terminal session or logs out, the kernel transmits a SIGHUP (Signal 1) to all child processes spawned by that shell session, causing active background jobs to terminate abruptly.

The nohup Command

nohup (No Hangup) launches a command configured to ignore SIGHUP. If standard output or standard error are not explicitly redirected, nohup automatically redirects both streams to an append-only log file named nohup.out:

# Run a long compilation or backup immune to terminal hangup:
$ nohup ./nightly_backup.sh &
[1] 5210
nohup: ignoring input and appending output to 'nohup.out'

The disown Shell Builtin

If a job is already running in the background and you need to log out without terminating it, disown removes the job from the current shell's active jobs table:

$ python3 long_worker.py &
[1] 5340

# Remove Job 1 from the shell table so SIGHUP won't be sent on logout:
$ disown %1

# Keep job in table but prevent SIGHUP transmission:
$ disown -h %1

# Disown all active background jobs at once:
$ disown -a

---

5. Terminal Multiplexers: screen and tmux

nohup and disown protect a single command from SIGHUP, but they give you no way back — once the terminal is gone, so is your ability to see output or type input. The 103.5 Terms and Utilities list therefore also names screen and tmux, the two terminal multiplexers that solve the whole problem: they run a persistent session on the server that survives disconnection and that you can reattach to later.

The Core Idea

A multiplexer runs as a daemon-like process detached from your terminal. Programs inside it have the multiplexer as their controlling terminal, so closing your SSH connection sends SIGHUP to the multiplexer's terminal, not to the shells inside it. Reconnect, reattach, and the work is exactly where you left it — screen contents, scrollback and all.

GNU screen

Default command prefix: Ctrl+a.

# Start a new named session
$ screen -S deployment

# Detach from inside the session
Ctrl+a  then  d

# List existing sessions
$ screen -ls
There is a screen on:
        14822.deployment        (Detached)

# Reattach by name or PID
$ screen -r deployment

# Force-detach it from wherever it is attached, then attach here
$ screen -dr deployment

tmux

The modern successor. Default command prefix: Ctrl+b.

# Start a new named session
$ tmux new -s build

# Detach from inside
Ctrl+b  then  d

# List sessions
$ tmux ls
build: 1 windows (created Fri Aug 29 09:14:02 2026)

# Reattach
$ tmux attach -t build

# Run a command in a fresh detached session, without ever attaching
$ tmux new -d -s nightly 'make release 2>&1 | tee /var/log/release.log'

Choosing Between the Four Tools

Exam Rule: Know the prefix keys — Ctrl+a for screen, Ctrl+b for tmux — and the detach/reattach pair for each (screen -r, tmux attach). The exam frames these as the answer whenever a scenario says an administrator must start a long task over SSH, disconnect, and later resume interacting with it; if the scenario only needs the command to survive logout with no further interaction, the answer is nohup.