What signals does OS X send for the Quit and Force Quit commands?

Solution 1:

As a general rule, the “Quit” operation is not a signal; it is an Apple Event, which is the same type of inter-process communication used for AppleScript scripting and for opening files or URLs in already-running applications, and comes from the Mac OS lineage rather than Unix.

A process has to specifically register to receive Apple Events, and such processes are either GUI processes or at least associated with a desktop session (which, outside of Activity Monitor, is the only way they can end up being told to quit at all).

However, if you “Quit” a process from Activity Monitor and that process has not registered to receive Apple Events, it will send SIGTERM (15) instead.

Solution 2:

You can use dtrace to see what signals are sent to processes:

sudo dtrace -n 'proc:::signal-send /pid/ { printf("%s -%d %d", execname, args[2], args[1]->pr_pid); }'

If you force quit an application that is shown in the Dock, the signal is usually -15 (TERM). But if you force quit a background process from Activity Monitor, it is usually -9 (KILL).

Solution 3:

You can view Force Quit events for GUI applications sent to system.log. Or, use dtrace as posted in this thread. With dtrace you get more granularity but need root privileges.