The most basic tasks you face with a Linux system are starting the machine properly and shutting it down when you are finished. Although the two processes sound simple, there are several ways of accomplishing each task and several hazards associated with performing the processes incorrectly. UNIX, as a whole, doesn't like shocks to the filesystem, such as fast power-offs, so you must carefully shut down the system to preserve your information.
This chapter looks at the startup and shutdown procedures used with Linux and the init daemon. The init daemon is probably the most important process running on any Linux system. Understanding what init does and how to use it properly can help you on the way to getting the best performance from your Linux system.
Starting the Linux system can be as simple as turning on the power switch of your PC. If Linux is configured to autoload, Linux will be up and running after a few seconds. Few systems are set up to run only Linux, though, and even fewer have it boot automatically when the power is turned on. Although automatic startup is convenient, many Linux users prefer to be able to choose which operating system to boot into (if other operating systems are loaded on the system) or to change the level of access to Linux.
You can start a Linux system by using a boot floppy disk or using LILO in one of several configurations. Each method has benefits and potential problems, which are discussed in the following sections.
LILO is the most common user method of booting a Linux system because it doesn't involve using a boot floppy disk. Chapter 4, "LILO," examined LILO in detail. LILO is a program that sits in the boot sector of a disk partition or the master boot record of the entire hard disk and points to the partition and location of the Linux kernel image.
If LILO is installed as a first-stage boot loader (meaning it boots Linux automatically), Linux starts to boot whenever the power is turned on. If you want to halt the boot process, you can use the Ctrl+Alt+Del sequence when the machine starts the boot sequence. (You must be careful when you hit Ctrl+Alt+Del, as you may reboot the machine by accident. Wait until you see the loader start its actions.) The Ctrl+Alt+Del sequence instructs LILO to pause and display the following prompt:
Boot:
From this boot prompt, you can tell LILO which operating system to load (DOS, Linux, OS/2, and so on). If you press the Tab key when the boot prompt is displayed, LILO displays a list of all partitions and operating systems it knows about. The operating system partitions must have their configuration information included in the LILO information. Providing this information is simply a matter of identifying the partition device name and a name for the operating system when you are creating the LILO configuration file. Chapter 4, "LILO," covered these steps.
Because LILO writes data to the disk drive that other operating systems cannot read, it is not always the best solution if you install and remove operating systems frequently from your hard disks. Whenever you make changes to the configuration of your Linux system or other partitions on the hard disk, update the LILO information by rerunning LILO.
If you don't want to rely on LILO (which modifies disk sectors and may cause problems when you use several operating systems or change operating systems frequently), you can use a boot floppy disk to start up Linux. A boot floppy disk is a single floppy disk that contains a complete copy of the Linux kernel and instructions for accessing the root partition on your hard drive. The boot floppy disk must be of the proper format to run on the first disk drive on your system (drive A in DOS terms). Linux cannot boot from a second (drive B) floppy disk drive.
In many ways, a boot floppy disk is the easiest and most versatile method of starting Linux. If, for example, you have your hard disk partitioned to contain both DOS and Linux, with DOS the normal boot partition, simply turning on your PC boots DOS without a hitch. If you want Linux to boot, you insert the boot floppy disk and start the machine. Linux boots from the floppy disk, and then accesses the hard drives as if it had booted from them.
If you are using a boot floppy disk to start Linux, be sure to update the kernel image on the floppy disk every time you make a change to the system that involves rebuilding the kernel. Keep in mind that you must rebuild the kernel almost every time you add devices or device drivers. Use the procedure outlined in the following paragraphs to update your existing floppy disk, or, even better, create a new floppy disk and save your current floppy disk for emergencies. You are not prompted to create a new boot floppy disk when you make changes to the kernel, so you must remember to perform this step.
To create a boot floppy disk, you need a blank, formatted, high-density floppy disk (1.44M or 1.2M, depending on the A drive on your system). Format the floppy disk under DOS to lay down the sector and track information properly for Linux to read. Some small kernels can fit on low-density floppy disks, but high-density drives are most likely to be used on your system because they are the standard. The high-density floppy disk can have information on it as well as the Linux kernel, but make sure you have enough disk space for the kernel image.
Some versions of Linux (such as Slackware) can create the boot floppy disk as part of the normal setup routine. If you are using a distribution that has a setup routine, try choosing the Configure option on the menu, follow through the prompts, and see whether you are prompted to create a boot floppy disk at the end. Alternatively, some distributions have a separate menu option for creating the boot floppy disk.
If you want to create the boot floppy disk manually, locate the Linux kernel on your system. Usually it is in the root directory. The kernel name changes depending on the version of Linux, but it is often called Image or vmlinux. Some versions of Linux store the kernel image in the /etc directory.
Some versions of Linux also store the kernel in a compressed format. The names of compressed kernels end in z, as in vmlinuz or vmlinux.z. A compressed kernel takes up less space on the hard disk or floppy disk, and it is decompressed when the Linux kernel boots. A compressed kernel takes a little longer to load than a kernel that isn't compressed, but because it is decompressed only when the system boots, the trade-off is usually beneficial (unless you have tons of empty disk space).
You should be able to find the kernel quite easily by watching the startup messages when you boot the system and noting the kernel name, and then using find or whereis to locate it. Much easier is to change to the root directory and look for a large file called Image or vmlinux. The file is owned by root and has only read permission in many distributions of Linux. For example, when you do a listing command (such as ls-l), you see an entry like the following:
-r-------- 1 root root 457700 Aug 10 13:52 vmlinuz
This entry shows a kernel image file of almost half a megabyte that is compressed. The date and time of the kernel match the last time you rebuilt the kernel or the time and date you installed Linux.
Once you have identified the kernel file, instruct Linux that the file is the root device and indicate which partition it is on by using the rdev command. For example, to set the root device to the kernel vmlinuz in the root directory of the partition /dev/sda3, you would issue the command
rdev /vmlinuz /dev/sda3
Because you must specify the path to the kernel completely, the leading slash is included to show the root directory.
If you issue the rdev command by itself, it displays the current partition of the root filesystem:
$rdev /dev/sda3 /
You can use this command to check the current settings if you are not sure which partition is your root filesystem. (This chapter looks at the rdev command in a little more detail in a later section.)
After you set the root device, you can copy the kernel to your formatted floppy disk. Use the cp command and the device name of the floppy disk:
cp /vmlinuz /dev/fd0
Once the image file has been transferred, the floppy disk should be able to boot Linux. If it doesn't, either the image didn't transfer properly due to a lack of disk space or a corrupted disk sector, or there is a problem with the kernel image.
Every system should have a maintenance disk (also called an emergency boot disk) that you can use to boot the Linux system in case anything happens to the boot system (such as LILO). A maintenance disk is a combination boot and root disk that boots a complete Linux kernel independent of your hard disk installation. After you load the maintenance disk, you can use it to mount the hard disk and check for problems, or use one of the hard disk utilities to rebuild LILO or the kernel, depending on the problem with the drive.
To create a maintenance disk, you create a root filesystem on a floppy disk, copy essential tools to it, install LILO, and then make the disk bootable by copying the kernel. Perform this process every time you make a change to the Linux kernel so that your maintenance disk has the same kernel build. Keeping your maintenance disk up-to-date prevents hassles with utilities and devices.
You probably already have a set of maintenance disks in the pair of floppy disks you used to install Linux in the first place. Although these disks are not configured for your system, you can use them to load Linux and mount your hard drive. Many Linux setup procedures have a built-in routine to create boot floppy disks. You can use this routine to create the maintenance floppy disk.
If you have to boot off the maintenance floppy disk for any reason, mount the existing hard drive with the mount command. For example, if you are booting off your floppy disk and want to mount the partition /dev/sda2 (which wouldn't boot Linux for some reason), issue the command
mount -t ext2 /dev/sda2 /mnt
which mounts the hard drive partition under the directory /mnt. The directory must exist before you perform this operation, and it should be empty. The -t option specifies the file type. If your filesystem is not an extended filesystem, change the type.
The temptation to treat Linux like DOS can be overwhelming when you are ready to finish with your session. Simply turning off the power should shut down everything, right? Well, it does, but it also can completely corrupt all the contents of your hard disk partition, as well as lose any information you were just working on. Granted, that's a very rare and extreme case, but arbitrarily turning off the power to a Linux session is still a bad idea.
Linux manages the hard disk and user spaces in RAM, using i-node tables to maintain the disk information and a memory manager for user information. Linux writes any changes to the i-node tables to the disk drive every so often, but it maintains the RAM copies as the most recent because of RAM's greater speed. If you shut down the power before Linux writes any changes to the disk, the disk contents and the i-node tables written on the disk may not match, causing lost files and an incorrect list of what disk space is available. Even worse, if Linux was in the process of writing the i-node table or any other information at the moment the power is turned off, the write process is interrupted, and disk head crashes or bad sector information can result. The same principle applies to any processes that are running. If, for example, you were running a database reindex when you killed the power, the indexes and databases may be corrupted. Shutting down the Linux system properly makes sure that all processes write and close all open files and terminate cleanly.
There are two easy ways to shut down the Linux system properly. The easiest is to use the Ctrl+Alt+Del sequence. On many Linux versions, this keyboard combination issues a shutdown command that closes all the processes properly, and then reboots the machine. Linux essentially traps the Ctrl+Alt+Del sequence and uses it to shut down the machine. Not all versions of Linux support this sequence, though, so check your documentation carefully.
If your system doesn't trap Ctrl+Alt+Del and reboots the machine when you issue it without shutting down Linux properly, it's the same effect as turning off the power. Make sure your Linux version supports this command before you use it!
The other method of shutting down Linux is with the UNIX command
shutdown
When you issue the shutdown command, Linux starts to terminate all processes and then shuts down the kernel. The shutdown command displays several different messages, depending on the version of Linux, but all inform you of the process or check that you really want to shut down the system.
The shutdown command allows you to specify a time until shutdown, as well as an optional warning message to be displayed to all users logged in. The format of the command is
shutdown time message
As an example, this command
shutdown 15 'Backup Time!'
shuts down the system after 15 minutes and display the message "Backup Time!" to all users on the system, prompting them to log off. This command is handy when you enforce a policy of shutting down at specific intervals, either for maintenance or backups.
In most versions of Linux, the shutdown command accepts the -r option. This option causes the PC to reboot after the shutdown has occurred. You can use this option to reboot to another operating system or to restart Linux after making changes to the kernel or devices. You can use the -r option with a time or message, if you want. The command
shutdown -r 5
reboots the system after five minutes.
In most cases, using Ctrl+Alt+Del or the shutdown command results in the display of a number of status messages on the main console. When Linux has finished shutting down the system, you see the message
The system is halted
When this message appears on-screen, it is safe to shut off the system power or reboot the machine. Although it may seem a little strange to have to follow these extra steps, you will find that many high-end operating systems such as UNIX (and even Windows NT and Windows 95) require you to follow a specific shutdown procedure to prevent loss of information. Get in the habit!
The init daemon is usually invoked as the last step in the booting of the Linux kernel. The init daemon is one of the most important Linux daemons because it creates processes for the rest of the system. The init daemon is executed when Linux starts and stays active until Linux is shut down. Understanding what init (and its linked utility telinit) does and how it controls the operating system is important to better administering the Linux system.
Both init and telinit use several configuration files to perform their tasks, so the following sections look at those files in detail, too. These files are closely involved in the starting and stopping of terminals and console sessions. The init program is usually kept in the /bin directory, although some versions of Linux keep it in /sbin. The same directories apply to the telinit utility. The configuration files are always kept in /etc, though.
When the init daemon is executed, it reads instructions from the file /etc/inittab, which is primarily used to start getty processes for terminals and other processes required by Linux. While examining the /etc/inittab file, init searches for an entry labeled initdefault, which sets the default initial run level of the system. If no initdefault level is defined in the /etc/inittab file, the system prompts for the level.
A run level is a particular set of processes ranging from a bare minimum for system administration only to a full operation supporting all configured devices. Run levels are defined by a number from zero to six. An additional superuser level (often called single-user level as only root can log in) is defined as s. The init daemon knows which processes are associated with each run level from information in the /etc/inittab file.
When you use the s run level to display the system in single-user mode, the /etc/inittab file is not read. Instead, the utility /bin/su is invoked for the system console (defined by /dev/console). The init process can save the current state of a system when instructed to change to single-user mode from a higher run level. With some versions of init, the current state of the system is saved in a file called /etc/ioctl.save by the program ioctl. When the console is restarted to a higher run level, the states in this file are restored. If no ioctl.save file is found, the default states are used.
When starting up into multiuser mode (run levels higher than single-user mode), the init daemon performs any entries identified by the instructions boot and bootwait in the /etc/inittab file. Following these instructions usually allows filesystems to be mounted. After these instructions are processed, the rest of the entries that match the selected run level are executed.
The run level of the system can be changed by a user with access to the commands that affect the level. This access is usually restricted to the system administrator for security reasons. You change the run level by using the utility program /etc/telinit (which is linked to /etc/init). The telinit utility is responsible for sending messages to the init daemon to alter the current run level to the requested new level. To alter the run level, add the required level (zero through six or s) to the telinit command. For example, the command
telinit 2
changes the run level to level two and causes init to reread the /etc/inittab file and execute all processes for that level or terminate those for higher levels. To drop into superuser (single-user) mode, use the s option:
telinit s
When switching to the superuser level, you can use either an uppercase or lowercase s. The telinit and init utilities can handle both cases.
You can specify a time delay for the change, in seconds, after the -t option. The command
telinit -t5 3
changes the run level to level three after five seconds. If no time is specified, Linux uses the default value of 20 seconds.
When you change the run level, init sends a SIGTERM warning signal to all processes that are not valid with the new run level. After sending the SIGTERM signal, init waits the specified number of seconds (or the default 20 seconds), and then terminates the process forcibly.
If a process started by init has spawned new processes that are not in the same process group, init doesn't terminate them when you change the run level. You must terminate these processes manually.
As mentioned previously, the /etc/inittab file is tied closely to the init daemon. Look at the /etc/inittab file on your system to understand which processes are started and which run level is invoked when Linux starts. Extracts from a sample /etc/inittab file show the processes involved in starting the system with init. The first section in the sample /etc/inittab file identifies the default run level, in this case level five:
id:5:initdefault:
The next section in the /etc/inittab file handles the system startup through the files in the /etc/rc.d directories:
si:S:sysinit:/etc/rc.d/rc.S
Following this section is a pointer to the file /etc/rc.d/rc.K, which is used when the system enters the single-user run level:
su:S:wait:/etc/rc.d/rc.K
Next is a pointer to the file /etc/rc.d/rc.M for when the system is started in multiuser level (any one of the levels one through six):
rc:123456:wait:/etc/rc.d/rc.M
The most common run level is five, which is the normal operating level for Linux in multiuser mode. Most installations seldom use the other levels, although they can be used in some circumstances to control access to peripherals. Run levels are best left as the system wants them to prevent problems. This means using run level s for superuser mode and run level five for general use.
Because Linux runs on PC machines, it can support the "three-fingered salute" or Ctrl+Alt+Del sequence. This sequence is not usually supported on PC UNIX systems, so a special instruction is mapped to the sequence in the /etc/inittab file:
ca::ctrlaltdel:/sbin/shutdown -t3 -rf now
When the Ctrl+Alt+Del sequence is intercepted, the system begins a shutdown as shown by the command at the end of the preceding line.
The /etc/inittab file then holds an instruction to start a getty process for each terminal and virtual screen on the system. This sample /etc/inittab file starts six virtual screens (tty1 through tty6) and two serial lines (ttyS0 and ttyS1):
c1:12345:respawn:/sbin/agetty 38400 tty1 c2:12345:respawn:/sbin/agetty 38400 tty2 c3:45:respawn:/sbin/agetty 38400 tty3 c4:45:respawn:/sbin/agetty 38400 tty4 c5:45:respawn:/sbin/agetty 38400 tty5 c6:456:respawn:/sbin/agetty 38400 tty6 s1:45:respawn:/sbin/agetty 19200 ttyS0 s2:45:respawn:/sbin/agetty 19200 ttyS1
The terminal and serial line instructions are examined in more detail in Chapter 11, "Terminals and term."
The lines in the /etc/inittab file follow a specific format. The format follows this pattern:
ID:runlevel:action:process
The ID is a one- or two-character string that uniquely identifies the entry. In most cases, this string corresponds to the device name, such as 1 for tty1, 2 for tty2, and so on. The runlevel decides which of the run levels the line applies to (varying from zero to six). If no entry is provided, then all run levels are supported. Multiple run levels may be identified in the field.
The action indicates the command to execute when init reads the line. The following items are all valid entries for the action field:
If init senses a powerfail condition (such as termination of power to the PC signaled by an Uninterruptible Power Supply) and the system was in multiuser mode, some special powerfail conditions are executed upon restart. These conditions usually check the filesystem for problems prior to bringing the system back up. The /etc/inittab file can contain specific instructions for these conditions, as shown in the following code:
# What to do when power fails (shutdown to single user). pf::powerfail:/sbin/shutdown -f +5 "THE POWER IS FAILING" # If power is back before shutdown, cancel the running shutdown. pg:0123456:powerokwait:/sbin/shutdown -c "THE POWER IS BACK" # If power comes back in single user mode, return to multi user mode. ps:S:powerokwait:/sbin/init 5
All these powerfail conditions assume that some device manages to send the powerfail signals to the init process. Special device drivers that interface with UPSs usually do this.
The init daemon doesn't terminate when it has finished reading /etc/inittab. It stays active and monitors the system for specific instructions to change the run level (from a telinit command). It is also responsible for watching all the processes it started, including the getty processes for terminals. Whenever a process init started (called a child process, with init as the parent process) is terminated for any reason, init records the event and a reason for the termination (if possible to identify) in the files /etc/utmp and /etc/wtmp.
Whenever init senses the termination of a a child process, a power fail signal, or a run level change, it rereads the /etc/inittab to check for instructions. You can make changes to the inittab file (using any ASCII editor) while the system is running, but the changes will not be effective until the system reboots or one of the reread conditions occurs. An alternative is to use the q argument to force init to reexamine the /etc/inittab file. To force a reread of the /etc/inittab file, issue the command
init q
The init process checks how many times it has to restart (respawn) a process. If a process must be restarted more than 10 times in a two minute period, init assumes that there is an error in the command line of /etc/inittab for that process and generates an error message on the system console. The init process then refuses to respawn that process for five minutes or until it's forced to restart by the superuser. This step is useful because it prevents the system from wasting CPU cycles when a typographic error was made in the /etc/inittab file.
The rdev command is a utility not just for identifying the root device, as shown earlier in this chapter (it's used when creating a boot floppy disk), but for obtaining all kinds of information about your Linux system and making some configuration changes. The rdev utility can be cumbersome to use, and many administrators ignore it and its companion utilities completely.
If you use LILO to boot Linux, you can ignore all the rdev commands as these parameters are set in the LILO configuration. The only times you will need rdev is when you change kernels and want to make a boot floppy disk for emergency use, or you want to change the RAM disk size. If you don't use LILO, you may occasionally need to use the rdev commands, although it is rare that they will be necessary as the Linux setup procedures define most of these parameters for you. The exception is changes in RAM disk size.
When run by itself, rdev displays the currently defined root partition and directory:
$dev /dev/sda3 /
In this example, /dev/sda3 (third partition on the first SCSI hard disk) is the current root partition. You can use rdev to change the root partition and point to the kernel image to be used by Linux by providing both parameters as arguments:
rdev /vmlinuz /dev/sda3
This command changes the kernel image used to vmlinuz in the root directory of the third partition. You usually perform this command only when you create an emergency floppy disk.
The rdev command has several options for changing the way it acts, as shown in the following list:
| -h | Displays help |
| -r | Makes rdev act like the command ramsize (see below) |
| -R | Makes rdev act like the rootflags command (see below) |
| -s | Makes rdev act like the swapdev command (see below) |
| -v | Makes rdev act like the vidmode command (see below) |
Although you can use these options to alter rdev's behavior, you can also use the following commands directly:
In order to change many of the parameters, you must specify an offset that indicates the decimal value of the kernel location with the rdev command, which is why many administrators don't like the command. To use rdev or one of the utilities in its family, you must calculate the offsets according to the following rules:
| Offset 498 | Root flags |
| Offset 504 | RAM disk size |
| Offset 506 | VGA mode |
| Offset 508 | Root device |
The rootflags command has many options, only one of which really works to enable you to mount the root directory as read-only. Because this feature is seldom (if ever) necessary, most administrators can effectively ignore the rootflags command. (If you are running off a CD-ROM or from a small hard drive that contains only the binaries, you may want to consider using rootflags, but because you can accomplish the same task using file permissions, there's not much need to use rootflags.)
The vidmode command (or rdev -v) lets you change the video mode. If you issue the vidmode command by itself with some versions of Linux, it displays the current settings. More recent versions (including the one on this book's CD-ROM) show a help screen:
$ vidmode usage: rdev [ -rsv ] [ -o OFFSET ] [ IMAGE [ VALUE [ OFFSET ] ] ] rdev /dev/fd0 (or rdev /linux, etc.) displays the current ROOT device rdev /dev/fd0 /dev/hda2 sets ROOT to /dev/hda2 rdev -R /dev/fd0 1 set the ROOTFLAGS (readonly status) rdev -s /dev/fd0 /dev/hda2 set the SWAP device rdev -r /dev/fd0 627 set the RAMDISK size rdev -v /dev/fd0 1 set the bootup VIDEOMODE rdev -o N ... use the byte offset N rootflags ... same as rdev -R swapdev ... same as rdev -s ramsize ... same as rdev -r vidmode ... same as rdev -v Note: video modes are: -3=Ask, -2=Extended, -1=NormalVga, 1=key1, 2=key2,... use -R 1 to mount root readonly, -R 0 for read/write.
The legal values for vidmode are as follows:
| -3 | Prompt |
| -2 | Extended VGA |
| -1 | Normal VGA |
| 0 | The same as pressing 0 at the prompt |
| 1 | The same as pressing 1 at the prompt |
| 2 | The same as pressing 2 at the prompt |
| n | The same as pressing n at the prompt |
You can change the video mode using one of these values on the command line or using a number or letter to emulate pressing a value at the prompt.
This chapter looked at the proper procedures for starting and stopping a Linux system. As you have seen, shutting down the system properly is vitally important. This chapter has also looked at the init process, an important aspect of the Linux system. Now that these basic procedures are out of the way, you are ready to look at some of the important aspects of system administration.
