* Somali Islamists linked to al Qaeda claim attack
* Al Shabaab demanding withdrawal of Kenyan troops from Somalia
* President loses relatives in raid, vows to punish attackers
Kenyan President Uhuru Kenyatta, facing his first major security challenge since his election in March, said more than 39 people had been killed, among them close members of his family.
A senior government official said on his Twitter feed that more than 300 people had been wounded in an attack that could prove a major setback for the the east African nation, which relies heavily on tourism.
The dead included children, and the wounded ranged in age from 2 to 78. Many victims were at a cooking competition when assailants stormed in with automatic rifles, witnesses said. Blood lay in pools in the mall. Shop windows were shattered.
More than 20 hours after the attack began, an unknown number of people were believed to still be inside, held by the attackers. The focus was on Nakumatt supermarket, one of Kenya's biggest chains.
Kenyatta said security forces were engaged in a "delicate operation," adding: "Our top priority remains to safeguard the lives of innocent people held up in this unfortunate incident."
Sporadic shooting continued for several hours after the attack, which began at around 12.30 p.m. (0930 GMT) on Saturday but had become a tense calm by the evening. Soldiers had joined the security operation backed by armoured personnel carriers.
"It's been quiet. They will be arranging how to attack," one paramilitary officer in green camouflage fatigues and a rifle slung over his shoulder, told Reuters close to the mall.
One woman emerged on Sunday morning after she said she had been hiding under a car in the basement. She was holding one shoe and looked dazed, and was making a frantic phone call to her husband who later met her, a Reuters witness said.
France said two of its citizens were killed, and Canada said two Canadians died, including a 29-year-old diplomat. A Chinese woman was also killed, China's official news agency said.
U.S. Secretary of State John Kerry, who offered assistance to Kenya in the incident, said several U.S. citizens had been hurt and the wife of a U.S. diplomat working for the U.S. Agency for International Development was killed.
Al Shabaab, which has links to al Qaeda and is battling Kenyan and other African peacekeepers in Somalia, had repeatedly threatened attacks on Kenyan soil if Nairobi did not pull its troops out of the Horn of Africa country.
The group appeared to taunt the security forces, saying on its official Twitter handle @HSM_Press that there would be no negotiations whatsoever with Kenyan officials over the standoff.
"10 hours have passed and the Mujahideen are still strong inside #Westgate Mall and still holding their ground. All praise is due to Allah!", the group said late on Saturday, although its account on Twitter was suspended on Sunday morning.
Kenyatta, who faces charges of crimes against humanity at a trial starting in November at the International Criminal Court, vowed to defeat the militants who have said it is time to shift the war to Kenyan soil.
"We have overcome terrorist attacks before," he said.
The assault was the biggest single attack in Kenya since al Qaeda's East Africa cell bombed the U.S. Embassy in Nairobi in 1998, killing more than 200 people. In 2002, the same militant cell attacked an Israeli-owned hotel on the coast and tried to shoot down an Israeli jet in a coordinated attack.
GETTING OUT ALIVE
Relatives of hostages thought still to be trapped inside the mall were keeping vigil at a nearby religious community centre, waiting for the next move by the security forces.
Kevin Jamal said his sister was taken hostage while shopping at the mall, and he had been waiting for more than six hours.
"I want her to come out alive," Jamal told Reuters as he joined Kenya Red Cross Society volunteers, while saying Kenyan security forces could have done better. "They should not allow themselves to be outmanoeuvred by less than 20 people."
A private security firm would normally search patrons of the mall using metal detectors and open the trunks of cars entering parking areas, but the guards would be unarmed.
Nakumatt closed its other stores on Sunday, local media reported, while the mall was cordoned off and surrounded by police and paramilitary forces.
Police said it was not clear how many attackers they were dealing with, and those rescued said at least one of the attackers was a woman. One of the assailants had been shot and arrested, but died shortly afterwards at a hospital.
Witnesses said the attackers were armed with AK-47 rifles and wore ammunition belts. Police said they stormed in during a children's cooking competition hosted by a radio station at the mall, just as the winners were about to receive prizes.
In the darkness of Sunday morning, music still played. At a gourmet burger shop, a tray of food lay in a pool of blood on the spot where a man and woman had been killed and laid in a final embrace before their bodies were moved.
Kenya sent its troops into Somalia in October 2011 to pursue the militants it blamed for kidnapping tourists and attacking its security forces.
The major attack on a mall that draws tourists, expatriates and Kenya's wealthy elite risks hammering an already struggling tourism sector in Kenya and could puncture Kenyatta's plans to champion East Africa's biggest economy as a sound investment destination.
Al Shabaab's last big attack outside Somalia was a twin strike in neighbouring Uganda, targeting people watching the World Cup final on television in Kampala in June, 2010. Seventy-nine people died.