1.17 Bringing a System Down
1.17.1 Description
There are seven ways to bring down a system, but in the end you
really have only two choices: You can do it gracefully or you can do it the
hard way!
Reason
Why not always use a graceful method? Well, naturally you would
want to try to bring any system down in a graceful manner. But not all UNIX
systems allow a clean shutdown all the time. Sometimes while the system is processing
through a clean shutdown procedure it hangs. Some circumstances lead to bringing
the system down in a hard way. Here is a small list of reasons that can lead
you to bring the system down in a not-so-graceful way:
-
While the system is coming down the network processes hang
and the NFS mount points fail to unmount.
-
No matter how many times you initiate a command ( shutdown,
halt, telinit, and
so on) to take down the system, nothing happens.
- All access to the system is frozen and you cannot open a shell
in the console or connect remotely from over the network.
- A runaway process uses up all the CPU and the load average
is so high that no commands can be issued.
- On occasion, the process table fills up and a process or command
cannot be forked to bring the system down.
You really should do two things before you initiate any command
to bring down your system: verify the hostname of the system you want to shut
down and sync your disk!
In a networked UNIX environment with multiple shells to remote
systems, make sure you're on the right system by using the hostname
command. It takes only a second. If you support 50-100 systems, the odds are
that you will shut down the wrong system at least once a year. It will happen
when you are tired or not paying attention.
When
you sync the disks, you flush all modified inodes,
data block cache, and superblock cache to disks. Running sync
before the system is brought down minimizes the amount of damage that could
occur if the system were to crash or have to be taken down in a hard way.
# hostname
rocket
# sync
# sync
Line 1: Verify the correct host to shutdown.
Line 4: The first sync begins flushing
operation of inodes and cache, but it might not be finished by the time it returns
a shell prompt.
Line 5: This sync does not start until
the previous sync has completed. This guarantees
that all data is flushed.
Always run sync twice if you really
want to be sure that everything has been flushed. A daemon called update
will get started at boot time to automatically run sync
every 30 seconds. This doesn't mean that you don't have to run the
sync command. It takes less than a second for there
to be inconsistencies in the filesystem. The update
daemon can be somewhat of an insurance daemon. If the system crashes, update
might have had enough time to sync the disks.
Bringing
down a system depends on the system itself. Only you can determine which method
is right for the system in your environment. Workstations typically do not have
applications that contain a large amount of open files, such as database servers.
Larger servers are susceptible to major problems if a system crash were to occur.
Here is a list of ways a system can be taken down, from safe and graceful to
hard crash:
-
shutdown This is the cleanest, safest,
and best way to shut down any workstation or server if you need to halt,
reboot, or change the init state. It warns the users that a shutdown of
the system is imminent. It even closes up special files and exits out of
applications gracefully. You can define these in the shutdown script rc0.
- halt This command syncs
the disks by writing out any information pending and then stops any nonessential
processes. It places a shutdown record into the accounting file and logs the
shutdown of the system to the system log daemon. It does not execute the shutdown
script rc0.
- reboot Like the halt
command, this syncs the disks and stops any nonessential
processes, too. However, reboot restarts the kernel
that is loaded into memory by the PROM monitor.
- fasthalt and fastboot These commands
are identical to the halt and reboot
commands. The only difference is that when the system comes back up, a check
of the filesystems ( fsck) doesn't get run.
- telinit On systems that utilize multilevel
init functions, you can use the telinit
command to direct init to go to a specific run
level. It follows the same procedures as shutdown; the only difference is
that it does not notify users that the system is going down. It begins the
shutdown process.
- Power button, switch, or key The button
on the outside of some systems performs differently among different vendors.
With some systems, it merely acts as an on/off switch. On other systems pushing
the button attempts to sync the disks, shut down
the system, and initiate either a halt or a reboot
sequence. There are even some systems where pushing the button once attempts
to safely halt the system and pushing the button again powers the system off
even if the disks did not get a chance to sync.
Some vendors today have configured the hardware to sense a key switch and
attempt at the minimum to sync the disks before
powering the system off.
- Power cord Avoid at all cost . On
the rarest occasions it will be necessary to pull the power cord. Every vendor
and every system administrator will tell you not to do it! But there are times
when it is inevitable and must be done. You should never run into this situation
on a server, only at the workstation level.
Real World Experience
shutdown This command should
always be on any server with multiple users and sensitive applications that
need to be shutdown gracefully.
halt Typically, this command
is used on single user workstations and standalone systems. It is used rarely
on servers with multiple users.
reboot This is generally
used on an individual workstation by the user. This command is also often used
remotely over a network on a user's workstation when the UNIX administrator
is confident that the system will boot up without any incidents.
Fasthalt and fastboot These
commands are good to use on highly utilized systems when there is a system that
needs rebooting in the least amount of time. Candidates are any system that
provides a service such as mail, news, DNS, or NIS. Database servers are not
good candidates for these commands. This command is good for large fileservers
with over 50GB of space. If the filesystem is corrupted and doesn't mount
when the server comes up, you can always run a filesystem check on the corrupted
area, but the rest of the system would be up and running.
telinit If all the other
commands fail, this should be the next in line to try. The odds are that this
command will not work, though, because it is similar in function to shutdown.
Power button, switch, or key If bringing the system
down through the software doesn't work, there is no alternative but to
hit the power button, flip the key, or hit the power switch.
Power cord Usually this is kicked by a user or someone
working around a workstation and the infamous call comes in: "All of a
sudden, my computer has no power!" Most vendors have designed their systems
so administrators will never have to deal with this situation. However, I still
see one or two workstations where pulling out the power cord was necessary,
but never any server-level systems.
Other Resources
Man pages:
fasthalt, halt,
hostname, reboot, shutdown,
sync, telinit
© Copyright Macmillan USA. All rights
reserved.
Previous
Section