Thursday, February 24, 2005

Linux Run-Levels

Linux has 6 different run levels (or operating modes):

rc1.d - Single User Mode
rc2.d - Single User Mode with Networking
rc3.d - Multi-User Mode - boot up in text mode
rc4.d - Not yet Defined
rc5.d - Multi-User Mode - boot up in X Windows
rc6.d - Shutdown

Each mode has it's own list of settings for what services to start and what services to shutdown. Not only does this list contain what is supposed to be running, but also what order each service should be started in.
chkconfig - will list all the registered services and display thier status at each different run level.
Most of the time when your server boots up it will start in runlevel 3 or 5 depending on what it is set to. This setting can be found in the file /etc/inittab
If you ever want to change what mode your server defaults to on bootup, just edit that file, but NEVER change it to runlevel 6 or else you will set your server to shutdown on bootup.
RC.D Directory Explanation
In the folder: /etc/rc.d are all the run level folders starting from rc1.d to rc6.d and including init.d
It is in each of these rc#.d folders where the service run settings are kept. If you change directory into /etc/rc.d/rc3.d all the files that start with a capital S are the services that will start at this runlevel. All the files that start with a K are the services that will be killed at that runlevel.
The reason why services that are not supposed to run are still listed is because it is popular to switch a server from one run level to another instead of just booting into the needed run level. That way you can take your server offline (single user mode) and then apply a patch or do a file restore.
Let's take a closer look at these files that are inside the rc#.d folders. Notice that they are symbolic links to the script file located in /etc/rc.d/init.d This makes things very easy. All the commands to start, stop, or reload a service are handled by these scripts. So when a server is to go into a specific run level it can find the correct script and knows whether to start it based on its name and link path.
Switching Run Levels
init

Run levels are configured in /etc/inittab by lines like the following:

l2:2:wait:/etc/init.d/rc 2
The first field is an arbitrary label, the second one means that this applies for run level 2. The third field means that init should run the command in the fourth field once, when the run level is entered, and that init should wait for it to complete. The /etc/init.d/rc command runs whatever commands are necessary to start and stop services to enter run level 2.
The command in the fourth field does all the hard work of setting up a run level. It starts services that aren't already running, and stops services that shouldn't be running in the new run level any more. Exactly what the command is, and how run levels are configured, depends on the Linux distribution.

When init starts, it looks for a line in /etc/inittab that specifies the default run level:
id:2:initdefault:
You can ask init to go to a non-default run level at startup by giving the kernel a command line argument of single or emergency. Kernel command line arguments can be given via LILO, for example. This allows you to choose the single user mode (run level 1).
While the system is running, the telinit command can change the run level. When the run level is changed, init runs the relevant command from /etc/inittab.


The kernel, once it is loaded, finds init in sbin and executes it.
When init starts, it becomes the parent or grandparent of all of the processes that start up automatically on your Linux system. The first thing init does, is reading its initialization file, /etc/inittab. This instructs init to read an initial configuration script for the environment, which sets the path, starts swapping, checks the file systems, and so on. Basically, this step takes care of everything that your system needs to have done at system initialization: setting the clock, initializing serial ports and so forth.
Then init continues to read the /etc/inittab file, which describes how the system should be set up in each run level and sets the default run level. A run level is a configuration of processes. All UNIX-like systems can be run in different process configurations, such as the single user mode, which is referred to as run level 1 or run level S (or s). In this mode, only the system administrator can connect to the system. It is used to perform maintenance tasks without risks of damaging the system or user data. Naturally, in this configuration we don't need to offer user services, so they will all be disabled. Another run level is the reboot run level, or run level 6, which shuts down all running services according to the appropriate procedures and then restarts the system

Commonly, run level 3 is configured to be text mode on a Linux machine, and run level 5 initializes the graphical login and environment.

After having determined the default run level for your system, init starts all of the background processes necessary for the system to run by looking in the appropriate rc directory for that run level. init runs each of the kill scripts (their file names start with a K) with a stop parameter. It then runs all of the start scripts (their file names start with an S) in the appropriate run level directory so that all services and applications are started correctly. In fact, you can execute these same scripts manually after the system is finished booting with a command like /etc/rc.d/init.d/httpd stop or service httpd stop logged in as root, in this case stopping the web server.
None of the scripts that actually start and stop the services are located in /etc/rc.d/rc.d. Rather, all of the files in /etc/rc.d/rc.d are symbolic links that point to the actual scripts located in /etc/rc.d/init.d. A symbolic link is nothing more than a file that points to another file, and is used in this case because it can be created and deleted without affecting the actual scripts that kill or start the services. The symbolic links to the various scripts are numbered in a particular order so that they start in that order. You can change the order in which the services start up or are killed by changing the name of the symbolic link that refers to the script that actually controls the service. You can use the same number multiple times if you want a particular service started or stopped right before or after another service.

Below a sample of /etc/rc5.d content, which lists the services started up in run level 5:
[jean@blub /etc/rc5.d] ls
K15httpd@ K45named@ S08ipchains@ S25netfs@ S85gpm@
K16rarpd@ K46radvd@ S08iptables@ S26apmd@ S90crond@
K20nfs@ K61ldap@ S09isdn@ S28autofs@ S90xfs@
K20rstatd@ K65identd@ S10network@ S30nscd@ S95anacron@
K20rusersd@ K74ntpd@ S12syslog@ S55sshd@ S95atd@
K20rwalld@ K74ypserv@ S13portmap@ S56rawdevices@ S97rhnsd@
K20rwhod@ K74ypxfrd@ S14nfslock@ S56xinetd@ S99local@
K25squid@ K89bcm5820@ S17keytable@ S60lpd@
K34yppasswdd@ S05kudzu@ S20random@ S80sendmail@

After init has progressed through the run levels to get to the default run level, the /etc/inittab script forks a getty process for each virtual console (login prompt in text mode). getty opens tty lines, sets their modes, prints the login prompt, gets the user's name, and then initiates a login process for that user. This allows users to authenticate themselves to the system and use it. By default, most systems offer 6 virtual consoles, but as you can see from the inittab file, this is configurable.
/etc/inittab can also tell init how it should handle a user pressing Ctrl+Alt+Delete at the console. As the system should be properly shut down and restarted rather than immediately power-cycled, init is told to execute the command /sbin/shutdown -t3 -r now, for instance, when a user hits those keys. In addition, /etc/inittab states what init should do in case of power failures, if your system has a UPS unit attached to it.
In run level 5, /etc/inittab runs a script called /etc/X11/prefdm. The prefdm script runs the preferred X display manager, based on the contents of the /etc/sysconfig/desktop directory. This is typically gdm if you run GNOME or kdm if you run KDE, but they can be mixed, and there's also the xdm that comes with a standard X installation.
The /etc/sysconfig directory contains entries for a range of functions and services, these are all read at boot time. This last part, however, might be somewhat different depending on your Linux distribution.
Besides the graphical user environment, a lot of other services may be started as well. But if all goes well, you should be looking at a login prompt or login screen when the boot process has finished.

No comments: