The most basic tasks you face with a Linux system are starting the machine properly and
shutting it down when you are finished. Although the two processes sound simple, there are
several ways of accomplishing each task and several hazards associated with performing the
processes incorrectly. UNIX, as a whole, doesn't like shocks to the filesystem, such as
fast power-offs, so you must carefully shut down the system to preserve your information.
This chapter looks at the startup and shutdown procedures used with Linux and the init
daemon. The init daemon is probably the most important process running on any Linux
system. Understanding what init does and how to use it properly can help you on the way to
getting the best performance from your Linux system.
Starting the Linux system can be as simple as turning on the power switch of your PC.
If Linux is configured to autoload, Linux will be up and running after a few seconds. Few
systems are set up to run only Linux, though, and even fewer have it boot automatically
when the power is turned on. Although automatic startup is convenient, many Linux users
prefer to be able to choose which operating system to boot into (if other operating
systems are loaded on the system) or to change the level of access to Linux.
You can start a Linux system by using a boot floppy disk or using LILO in one of
several configurations. Each method has benefits and potential problems, which are
discussed in the following sections.
LILO is the most common user method of booting a Linux system because it doesn't
involve using a boot floppy disk. Chapter 4, "LILO,"
examined LILO in detail. LILO is a program that sits in the boot sector of a disk
partition or the master boot record of the entire hard disk and points to the partition
and location of the Linux kernel image.
If LILO is installed as a first-stage boot loader (meaning it boots Linux
automatically), Linux starts to boot whenever the power is turned on. If you want to halt
the boot process, you can use the Ctrl+Alt+Del sequence when the machine starts the boot
sequence. (You must be careful when you hit Ctrl+Alt+Del, as you may reboot the machine by
accident. Wait until you see the loader start its actions.) The Ctrl+Alt+Del sequence
instructs LILO to pause and display the following prompt:
Boot:
From this boot prompt, you can tell LILO which operating system to load (DOS, Linux,
OS/2, and so on). If you press the Tab key when the boot prompt is displayed, LILO
displays a list of all partitions and operating systems it knows about. The operating
system partitions must have their configuration information included in the LILO
information. Providing this information is simply a matter of identifying the partition
device name and a name for the operating system when you are creating the LILO
configuration file. Chapter 4, "LILO," covered these
steps.
Because LILO writes data to the disk drive that other operating systems cannot read, it
is not always the best solution if you install and remove operating systems frequently
from your hard disks. Whenever you make changes to the configuration of your Linux system
or other partitions on the hard disk, update the LILO information by rerunning LILO.
If you don't want to rely on LILO (which modifies disk sectors and may cause problems
when you use several operating systems or change operating systems frequently), you can
use a boot floppy disk to start up Linux. A boot floppy disk is a single floppy disk that
contains a complete copy of the Linux kernel and instructions for accessing the root
partition on your hard drive. The boot floppy disk must be of the proper format to run on
the first disk drive on your system (drive A in DOS terms). Linux cannot boot from a
second (drive B) floppy disk drive.
In many ways, a boot floppy disk is the easiest and most versatile method of starting
Linux. If, for example, you have your hard disk partitioned to contain both DOS and Linux,
with DOS the normal boot partition, simply turning on your PC boots DOS without a hitch.
If you want Linux to boot, you insert the boot floppy disk and start the machine. Linux
boots from the floppy disk, and then accesses the hard drives as if it had booted from
them.
If you are using a boot floppy disk to start Linux, be sure to update the kernel image
on the floppy disk every time you make a change to the system that involves rebuilding the
kernel. Keep in mind that you must rebuild the kernel almost every time you add devices or
device drivers. Use the procedure outlined in the following paragraphs to update your
existing floppy disk, or, even better, create a new floppy disk and save your current
floppy disk for emergencies. You are not prompted to create a new boot floppy disk when
you make changes to the kernel, so you must remember to perform this step.
To create a boot floppy disk, you need a blank, formatted, high-density floppy disk
(1.44M or 1.2M, depending on the A drive on your system). Format the floppy disk under DOS
to lay down the sector and track information properly for Linux to read. Some small
kernels can fit on low-density floppy disks, but high-density drives are most likely to be
used on your system because they are the standard. The high-density floppy disk can have
information on it as well as the Linux kernel, but make sure you have enough disk space
for the kernel image.
Some versions of Linux (such as Slackware) can create the boot floppy disk as part of
the normal setup routine. If you are using a distribution that has a setup routine, try
choosing the Configure option on the menu, follow through the prompts, and see whether you
are prompted to create a boot floppy disk at the end. Alternatively, some distributions
have a separate menu option for creating the boot floppy disk.
If you want to create the boot floppy disk manually, locate the Linux kernel on your
system. Usually it is in the root directory. The kernel name changes depending on the
version of Linux, but it is often called Image or vmlinux. Some versions of Linux store
the kernel image in the /etc directory.
Some versions of Linux also store the kernel in a compressed format. The names of
compressed kernels end in z, as in vmlinuz or vmlinux.z. A compressed kernel takes
up less space on the hard disk or floppy disk, and it is decompressed when the Linux
kernel boots. A compressed kernel takes a little longer to load than a kernel that isn't
compressed, but because it is decompressed only when the system boots, the trade-off is
usually beneficial (unless you have tons of empty disk space).
You should be able to find the kernel quite easily by watching the startup messages
when you boot the system and noting the kernel name, and then using find or whereis to
locate it. Much easier is to change to the root directory and look for a large file called
Image or vmlinux. The file is owned by root and has only read permission in many
distributions of Linux. For example, when you do a listing command (such as ls-l), you see
an entry like the following:
-r-------- 1 root root 457700 Aug 10 13:52 vmlinuz
This entry shows a kernel image file of almost half a megabyte that is compressed. The
date and time of the kernel match the last time you rebuilt the kernel or the time and
date you installed Linux.
Once you have identified the kernel file, instruct Linux that the file is the root
device and indicate which partition it is on by using the rdev command. For example, to
set the root device to the kernel vmlinuz in the root directory of the partition
/dev/sda3, you would issue the command
rdev /vmlinuz /dev/sda3
Because you must specify the path to the kernel completely, the leading slash is
included to show the root directory.
If you issue the rdev command by itself, it displays the current partition of the root
filesystem:
$rdev
/dev/sda3 /
You can use this command to check the current settings if you are not sure which
partition is your root filesystem. (This chapter looks at the rdev command in a little
more detail in a later section.)
After you set the root device, you can copy the kernel to your formatted floppy disk.
Use the cp command and the device name of the floppy disk:
cp /vmlinuz /dev/fd0
Once the image file has been transferred, the floppy disk should be able to boot Linux.
If it doesn't, either the image didn't transfer properly due to a lack of disk space or a
corrupted disk sector, or there is a problem with the kernel image.
Every system should have a maintenance disk (also called an emergency boot disk) that
you can use to boot the Linux system in case anything happens to the boot system (such as
LILO). A maintenance disk is a combination boot and root disk that boots a complete Linux
kernel independent of your hard disk installation. After you load the maintenance disk,
you can use it to mount the hard disk and check for problems, or use one of the hard disk
utilities to rebuild LILO or the kernel, depending on the problem with the drive.
To create a maintenance disk, you create a root filesystem on a floppy disk, copy
essential tools to it, install LILO, and then make the disk bootable by copying the
kernel. Perform this process every time you make a change to the Linux kernel so that your
maintenance disk has the same kernel build. Keeping your maintenance disk up-to-date
prevents hassles with utilities and devices.
You probably already have a set of maintenance disks in the pair of floppy disks you
used to install Linux in the first place. Although these disks are not configured for your
system, you can use them to load Linux and mount your hard drive. Many Linux setup
procedures have a built-in routine to create boot floppy disks. You can use this routine
to create the maintenance floppy disk.
If you have to boot off the maintenance floppy disk for any reason, mount the existing
hard drive with the mount command. For example, if you are booting off your floppy disk
and want to mount the partition /dev/sda2 (which wouldn't boot Linux for some reason),
issue the command
mount -t ext2 /dev/sda2 /mnt
which mounts the hard drive partition under the directory /mnt. The directory must
exist before you perform this operation, and it should be empty. The -t option specifies
the file type. If your filesystem is not an extended filesystem, change the type.
The temptation to treat Linux like DOS can be overwhelming when you are ready to finish
with your session. Simply turning off the power should shut down everything, right? Well,
it does, but it also can completely corrupt all the contents of your hard disk partition,
as well as lose any information you were just working on. Granted, that's a very rare and
extreme case, but arbitrarily turning off the power to a Linux session is still a bad
idea.
Linux manages the hard disk and user spaces in RAM, using i-node tables to maintain the
disk information and a memory manager for user information. Linux writes any changes to
the i-node tables to the disk drive every so often, but it maintains the RAM copies as the
most recent because of RAM's greater speed. If you shut down the power before Linux writes
any changes to the disk, the disk contents and the i-node tables written on the disk may
not match, causing lost files and an incorrect list of what disk space is available. Even
worse, if Linux was in the process of writing the i-node table or any other information at
the moment the power is turned off, the write process is interrupted, and disk head
crashes or bad sector information can result. The same principle applies to any processes
that are running. If, for example, you were running a database reindex when you killed the
power, the indexes and databases may be corrupted. Shutting down the Linux system properly
makes sure that all processes write and close all open files and terminate cleanly.
There are two easy ways to shut down the Linux system properly. The easiest is to use
the Ctrl+Alt+Del sequence. On many Linux versions, this keyboard combination issues a
shutdown command that closes all the processes properly, and then reboots the machine.
Linux essentially traps the Ctrl+Alt+Del sequence and uses it to shut down the machine.
Not all versions of Linux support this sequence, though, so check your documentation
carefully.
If your system doesn't trap Ctrl+Alt+Del and reboots the machine when you issue it without shutting down Linux properly, it's the same effect as turning off the power. Make sure your Linux version supports this command before you use it!
The other method of shutting down Linux is with the UNIX command
shutdown
When you issue the shutdown command, Linux starts to terminate all processes and then
shuts down the kernel. The shutdown command displays several different messages, depending
on the version of Linux, but all inform you of the process or check that you really want
to shut down the system.
The shutdown command allows you to specify a time until shutdown, as well as an
optional warning message to be displayed to all users logged in. The format of the command
is
shutdown time message
As an example, this command
shutdown 15 'Backup Time!'
shuts down the system after 15 minutes and display the message "Backup Time!"
to all users on the system, prompting them to log off. This command is handy when you
enforce a policy of shutting down at specific intervals, either for maintenance or
backups.
In most versions of Linux, the shutdown command accepts the -r option. This option
causes the PC to reboot after the shutdown has occurred. You can use this option to reboot
to another operating system or to restart Linux after making changes to the kernel or
devices. You can use the -r option with a time or message, if you want. The command
shutdown -r 5
reboots the system after five minutes.
In most cases, using Ctrl+Alt+Del or the shutdown command results in the display of a
number of status messages on the main console. When Linux has finished shutting down the
system, you see the message
The system is halted
When this message appears on-screen, it is safe to shut off the system power or reboot
the machine. Although it may seem a little strange to have to follow these extra steps,
you will find that many high-end operating systems such as UNIX (and even Windows NT and
Windows 95) require you to follow a specific shutdown procedure to prevent loss of
information. Get in the habit!
The init daemon is usually invoked as the last step in the booting of the Linux kernel.
The init daemon is one of the most important Linux daemons because it creates processes
for the rest of the system. The init daemon is executed when Linux starts and stays active
until Linux is shut down. Understanding what init (and its linked utility telinit) does
and how it controls the operating system is important to better administering the Linux
system.
Both init and telinit use several configuration files to perform their tasks, so the
following sections look at those files in detail, too. These files are closely involved in
the starting and stopping of terminals and console sessions. The init program is usually
kept in the /bin directory, although some versions of Linux keep it in /sbin. The same
directories apply to the telinit utility. The configuration files are always kept in /etc,
though.
When the init daemon is executed, it reads instructions from the file /etc/inittab,
which is primarily used to start getty processes for terminals and other processes
required by Linux. While examining the /etc/inittab file, init searches for an entry
labeled initdefault, which sets the default initial run level of the system. If no
initdefault level is defined in the /etc/inittab file, the system prompts for the level.
A run level is a particular set of processes ranging from a bare minimum for system
administration only to a full operation supporting all configured devices. Run levels are
defined by a number from zero to six. An additional superuser level (often called
single-user level as only root can log in) is defined as s. The init daemon knows
which processes are associated with each run level from information in the /etc/inittab
file.
When you use the s run level to display the system in single-user mode, the
/etc/inittab file is not read. Instead, the utility /bin/su is invoked for the system
console (defined by /dev/console). The init process can save the current state of a system
when instructed to change to single-user mode from a higher run level. With some versions
of init, the current state of the system is saved in a file called /etc/ioctl.save by the
program ioctl. When the console is restarted to a higher run level, the states in this
file are restored. If no ioctl.save file is found, the default states are used.
When starting up into multiuser mode (run levels higher than single-user mode), the
init daemon performs any entries identified by the instructions boot and bootwait in the
/etc/inittab file. Following these instructions usually allows filesystems to be mounted.
After these instructions are processed, the rest of the entries that match the selected
run level are executed.
The run level of the system can be changed by a user with access to the commands that
affect the level. This access is usually restricted to the system administrator for
security reasons. You change the run level by using the utility program /etc/telinit
(which is linked to /etc/init). The telinit utility is responsible for sending messages to
the init daemon to alter the current run level to the requested new level. To alter the
run level, add the required level (zero through six or s) to the telinit command. For
example, the command
telinit 2
changes the run level to level two and causes init to reread the /etc/inittab file and
execute all processes for that level or terminate those for higher levels. To drop into
superuser (single-user) mode, use the s option:
telinit s
When switching to the superuser level, you can use either an uppercase or lowercase s. The telinit and init utilities can handle both cases.
You can specify a time delay for the change, in seconds, after the -t option. The
command
telinit -t5 3
changes the run level to level three after five seconds. If no time is specified, Linux
uses the default value of 20 seconds.
When you change the run level, init sends a SIGTERM warning signal to all processes
that are not valid with the new run level. After sending the SIGTERM signal, init waits
the specified number of seconds (or the default 20 seconds), and then terminates the
process forcibly.
If a process started by init has spawned new processes that are not in the same process group, init doesn't terminate them when you change the run level. You must terminate these processes manually.
As mentioned previously, the /etc/inittab file is tied closely to the init daemon. Look
at the /etc/inittab file on your system to understand which processes are started and
which run level is invoked when Linux starts. Extracts from a sample /etc/inittab file
show the processes involved in starting the system with init. The first section in the
sample /etc/inittab file identifies the default run level, in this case level five:
id:5:initdefault:
The next section in the /etc/inittab file handles the system startup through the files
in the /etc/rc.d directories:
si:S:sysinit:/etc/rc.d/rc.S
Following this section is a pointer to the file /etc/rc.d/rc.K, which is used when the
system enters the single-user run level:
su:S:wait:/etc/rc.d/rc.K
Next is a pointer to the file /etc/rc.d/rc.M for when the system is started in
multiuser level (any one of the levels one through six):
rc:123456:wait:/etc/rc.d/rc.M
The most common run level is five, which is the normal operating level for Linux in
multiuser mode. Most installations seldom use the other levels, although they can be used
in some circumstances to control access to peripherals. Run levels are best left as the
system wants them to prevent problems. This means using run level s for superuser mode and
run level five for general use.
Because Linux runs on PC machines, it can support the "three-fingered salute"
or Ctrl+Alt+Del sequence. This sequence is not usually supported on PC UNIX systems, so a
special instruction is mapped to the sequence in the /etc/inittab file:
ca::ctrlaltdel:/sbin/shutdown -t3 -rf now
When the Ctrl+Alt+Del sequence is intercepted, the system begins a shutdown as shown by
the command at the end of the preceding line.
The /etc/inittab file then holds an instruction to start a getty process for each
terminal and virtual screen on the system. This sample /etc/inittab file starts six
virtual screens (tty1 through tty6) and two serial lines (ttyS0 and ttyS1):
c1:12345:respawn:/sbin/agetty 38400 tty1 c2:12345:respawn:/sbin/agetty 38400 tty2 c3:45:respawn:/sbin/agetty 38400 tty3 c4:45:respawn:/sbin/agetty 38400 tty4 c5:45:respawn:/sbin/agetty 38400 tty5 c6:456:respawn:/sbin/agetty 38400 tty6 s1:45:respawn:/sbin/agetty 19200 ttyS0 s2:45:respawn:/sbin/agetty 19200 ttyS1
The terminal and serial line instructions are examined in more detail in Chapter 11, "Terminals and term."
The lines in the /etc/inittab file follow a specific format. The format follows this
pattern:
ID:runlevel:action:process
The ID is a one- or two-character string that uniquely identifies the entry. In most
cases, this string corresponds to the device name, such as 1 for tty1, 2 for tty2, and so
on. The runlevel decides which of the run levels the line applies to (varying from zero to
six). If no entry is provided, then all run levels are supported. Multiple run levels may
be identified in the field.
The action indicates the command to execute when init reads the line. The following
items are all valid entries for the action field:
If init senses a powerfail condition (such as termination of power to the PC signaled
by an Uninterruptible Power Supply) and the system was in multiuser mode, some special
powerfail conditions are executed upon restart. These conditions usually check the
filesystem for problems prior to bringing the system back up. The /etc/inittab file can
contain specific instructions for these conditions, as shown in the following code:
# What to do when power fails (shutdown to single user).
pf::powerfail:/sbin/shutdown -f +5 "THE POWER IS FAILING"
# If power is back before shutdown, cancel the running shutdown.
pg:0123456:powerokwait:/sbin/shutdown -c "THE POWER IS BACK"
# If power comes back in single user mode, return to multi user mode.
ps:S:powerokwait:/sbin/init 5
All these powerfail conditions assume that some device manages to send the powerfail
signals to the init process. Special device drivers that interface with UPSs usually do
this.
The init daemon doesn't terminate when it has finished reading /etc/inittab. It stays
active and monitors the system for specific instructions to change the run level (from a
telinit command). It is also responsible for watching all the processes it started,
including the getty processes for terminals. Whenever a process init started (called a
child process, with init as the parent process) is terminated for any reason, init records
the event and a reason for the termination (if possible to identify) in the files
/etc/utmp and /etc/wtmp.
Whenever init senses the termination of a a child process, a power fail signal, or a
run level change, it rereads the /etc/inittab to check for instructions. You can make
changes to the inittab file (using any ASCII editor) while the system is running, but the
changes will not be effective until the system reboots or one of the reread conditions
occurs. An alternative is to use the q argument to force init to reexamine the
/etc/inittab file. To force a reread of the /etc/inittab file, issue the command
init q
The init process checks how many times it has to restart (respawn) a process. If a
process must be restarted more than 10 times in a two minute period, init assumes that
there is an error in the command line of /etc/inittab for that process and generates an
error message on the system console. The init process then refuses to respawn that process
for five minutes or until it's forced to restart by the superuser. This step is useful
because it prevents the system from wasting CPU cycles when a typographic error was made
in the /etc/inittab file.
The rdev command is a utility not just for identifying the root device, as shown
earlier in this chapter (it's used when creating a boot floppy disk), but for obtaining
all kinds of information about your Linux system and making some configuration changes.
The rdev utility can be cumbersome to use, and many administrators ignore it and its
companion utilities completely.
If you use LILO to boot Linux, you can ignore all the rdev commands as these parameters are set in the LILO configuration. The only times you will need rdev is when you change kernels and want to make a boot floppy disk for emergency use, or you want to change the RAM disk size. If you don't use LILO, you may occasionally need to use the rdev commands, although it is rare that they will be necessary as the Linux setup procedures define most of these parameters for you. The exception is changes in RAM disk size.
When run by itself, rdev displays the currently defined root partition and directory:
$dev
/dev/sda3 /
In this example, /dev/sda3 (third partition on the first SCSI hard disk) is the current
root partition. You can use rdev to change the root partition and point to the kernel
image to be used by Linux by providing both parameters as arguments:
rdev /vmlinuz /dev/sda3
This command changes the kernel image used to vmlinuz in the root directory of the
third partition. You usually perform this command only when you create an emergency floppy
disk.
The rdev command has several options for changing the way it acts, as shown in the
following list:
| -h | Displays help |
| -r | Makes rdev act like the command ramsize (see below) |
| -R | Makes rdev act like the rootflags command (see below) |
| -s | Makes rdev act like the swapdev command (see below) |
| -v | Makes rdev act like the vidmode command (see below) |
Although you can use these options to alter rdev's behavior, you can also use the
following commands directly:
In order to change many of the parameters, you must specify an offset that indicates
the decimal value of the kernel location with the rdev command, which is why many
administrators don't like the command. To use rdev or one of the utilities in its family,
you must calculate the offsets according to the following rules:
| Offset 498 | Root flags |
| Offset 504 | RAM disk size |
| Offset 506 | VGA mode |
| Offset 508 | Root device |
The rootflags command has many options, only one of which really works to enable you to
mount the root directory as read-only. Because this feature is seldom (if ever) necessary,
most administrators can effectively ignore the rootflags command. (If you are running off
a CD-ROM or from a small hard drive that contains only the binaries, you may want to
consider using rootflags, but because you can accomplish the same task using file
permissions, there's not much need to use rootflags.)
The vidmode command (or rdev -v) lets you change the video mode. If you issue the
vidmode command by itself with some versions of Linux, it displays the current settings.
More recent versions (including the one on this book's CD-ROM) show a help screen:
$ vidmode usage: rdev [ -rsv ] [ -o OFFSET ] [ IMAGE [ VALUE [ OFFSET ] ] ] rdev /dev/fd0 (or rdev /linux, etc.) displays the current ROOT device rdev /dev/fd0 /dev/hda2 sets ROOT to /dev/hda2 rdev -R /dev/fd0 1 set the ROOTFLAGS (readonly status) rdev -s /dev/fd0 /dev/hda2 set the SWAP device rdev -r /dev/fd0 627 set the RAMDISK size rdev -v /dev/fd0 1 set the bootup VIDEOMODE rdev -o N ... use the byte offset N rootflags ... same as rdev -R swapdev ... same as rdev -s ramsize ... same as rdev -r vidmode ... same as rdev -v Note: video modes are: -3=Ask, -2=Extended, -1=NormalVga, 1=key1, 2=key2,... use -R 1 to mount root readonly, -R 0 for read/write.
The legal values for vidmode are as follows:
| -3 | Prompt |
| -2 | Extended VGA |
| -1 | Normal VGA |
| 0 | The same as pressing 0 at the prompt |
| 1 | The same as pressing 1 at the prompt |
| 2 | The same as pressing 2 at the prompt |
| n | The same as pressing n at the prompt |
You can change the video mode using one of these values on the command line or using a
number or letter to emulate pressing a value at the prompt.
This chapter looked at the proper procedures for starting and stopping a Linux system. As you have seen, shutting down the system properly is vitally important. This chapter has also looked at the init process, an important aspect of the Linux system. Now that these basic procedures are out of the way, you are ready to look at some of the important aspects of system administration.
