LOGS and BOOTUP Process

TOPICS

1. Boot Process
2. Kernel
3. Hardware and Kernel
4. PROC and SYSCTL
5. Logs Overview and SYSLOG

• BIOS initializes .
• BIOS calls boot loader, in RHEL it is GRUB.
• Bootloaders loads the first kernel image.
• GRUB then hands control to kernel which mounts the file system and start appropriates system services.
• The system services start up and log-in screen is displayed.
  
  
  
  KERNEL BOOT PROCESS
  
• kernel detects the hardware on the system and loads device drivers from its initial RAM file system
  initramfs-<kernel version>.img
• mount the root files system in read-only mode
• init is loaded
  
  LAST START UP STAGE

• init runs the necessary scripts in /etc/init.
• /etc/inittab is read for the default runlevel.
• Scripts for appropriate runlevel are started.
• User is presented with log in screen.
  
  
  GRUB (Grand Unified Boootloader)
  
• it works in two stages
• 1^st is a small program in first 446 bytes of boot sector
• 2^nd boot partition on the system

grub does not support LVM so it shall be located on a non LVM partition

shows instructions inside grub.conf

password protect grub

grub-md5-crypt generate a md5 encrypted

password: give your desired password

password:

vi /boot/grub/grub.conf

copy the password in grub.conf above the first title as follows

password –md5 password

:wq

UPSTART

• new system start up service, originally developed for ubuntu linux distribution
• in rhel 6, replace the old sysV init system
• SysV init started services sequentially.
• Upstart treateach service as an event andstarts services in parallel
• provides much fast boot experience

init

• init is the first process (PID 1)
• rest of process are child processes of init
• location is /sbin/init
• Configuration files for init/upstarts are in /etc/init

rcs.conf

• it is first script being called duringstartup byUpstart andlocated in /etc/init/rcS.conf
• it executes /etc/rc.d/rc.sysinit script
• reads /etc/inittab for default run level
• switch to default runlevel

                                                                        rc.init

• in /etc/rc.d/rc.sysinit
• sets system hostname
• starts networking
• mounts and check file system
• runs playmouth “progress bar”
• sets SELinux state
• sends messages to /var/log/dmesg

                                                                        rc.conf

location /etc/init/rc.conf

called by the /etc/init/rcs.conf file uses defaultrunlevel as set in /etc/inittab

executes the scripts located in /etc/rc.d/rcX.d “X is default runlevel”

                                                                      inittab

• in /etc/inittab
• used to be the main scripts file that init used during system start-up
• sets default runlevel, now it is the onlyjob left for inittab
• /etc/sysconfig/init------------sets color for plymoth,determines if single user mode will need password
• /etc/init/tty.conf---------------------creates the terminals (ctrl+alt+F1-F6)

                                                                   KERNEL

• Linux kernel was started by linus torvalds in aprin in 1991
• version 1.0 was released in mar, 1994
• version 2.0 wasreleased in sept, 1996
• version 2.60 was released in dec, 2003
• kernel is heart of os and responsible for
• System startup
• networking memory mgmt
• Security (SELinux, firewall, Permissions)
• RHEL version Scheme is respresented by:
• <major>.<minor>.<patch>-<build>.elx<architecture>
• RUN uname -r to see the kernel version
• NOTE:- rpm -ivh kernelname
  or
• yum install kernelname
• linux kernel in monolithic means that os runs within kernel space
• kernel loads device drivers known as kernel modules.these are loaded/unloaded dinamically
• kernel modules are located at /lob/modules/<kernel virsion>
• all the installed kernals are located in the /boot directory
• Example:
• -vmlinuz-2.1032-71.el6x86-64
• vmlinuz refers to the fact that linux kernel is stored in a compressed image file.
• PROCESS DIRECTORIES
• during run time, the /proc, /sys and /dev directories are created by kernel
• /proc is for running processes and kernel parameters
• /sys isfor system devices and their drives
• /dev provides acess points for devices and their drives
• Hardware & Kernel
• less dmesg display /var/log/dmesg
• lspci display devices attached PCI bus
• lspci -k device + kernel module attached
• lsusb display USB devices
• lsusb-t display in tree mode
• dmicode helps display detailed information about any hardware component on system

                                                               Kernel Modules

These are loaded/unloaded dynamically

# lsmod | less display current loaded modules

# modinfo sr_mod display modules info

# modprobe -r -v sr_mod unloads a modules

# lsmod | less shall not show the cd-ROM module

# modprobe sr_mod loads the modules

#lsmod | less

ls /lib/modules/$(uname-r)Kernel Display the kernel modules

PROC AND SYSCTL

• changes can be made to kernal parameters during the run time through “proc”
• changes mode in proc does not survive reboot
• os provides different commands to extract data from proc in good formate.

# ls /proc

# cat /proc/cpuinfo

# cat /proc/meminfo

# free -m

# cat /proc/mounts

# mount

Linux machine avt like router at run time

# cat /proc/sys/net/ipv4/ip_forward

# echo 1> /proc/sys/net/ipv4/ip_forward

it shall be off after reboot use sysctl to modify

vim/etc/sysctl

sysctl -a “shws the kernal parameters that can be modified

                                                     


                                                     LOGS OVERVIEW and SYSLOG

very important for trouble shooting
• all system logs are located under /var/log .Each service maintains its own logs under this directory
• logs need to be monitored constantly for the system safety and uptime
• primery log file is /var/log/messages.it includes messages from all system software and boot issues not related to kernel
• /var/log/dmesg includes messages form kernel during the boot process.it also includes information about h/w devices that are connected.
• Var/log/secure includes messages from SELinux and AVC(Access vector Cache)
• other logs may be
• /var/log/yum.log includes software installation logs
• var/log/boot.log includes system bootup messages
• var/log/httpd inclyudes logs from web server etc...
• tai -f logfile display log messages in real time
• dmesg utility to monitor kernel boot messages
• tail -f -n20 logfiles shall display 20 lines

                                                                           SYSLOG

• syslog is replaced by rsyslog daemon, it has certain feature like sending encryptione messages to remote log server or write logs directly to a mysql database

vim/etc/rsyslog.conf

got ot rules section

facility.priority e.g

cron* var/log/cron

cron.* *means priority which meaning

that any priroty message shall be sent to /var/log/cron

modify

kernel.*to

kern.crit /var/log/messages

:wq

service rsyslog reload

                                                   




                                                  SENDS LOGS TO REMOTE SERVER

vim /etc/rsyslog.conf

scroll down to bottom of file

unmark and replace

#*.*@@remotehost:514

@@ means communication only over TCP

@ means comm only over UDP

with

*.*@@ipofserver:514

:wq

service rsyslog reload