Chapter 3: Operate Running

Systems
Liban Bashir
Network Security Administrator/
Former SYSTEM ADMIN
RHCSA / RHCE & RED HAT
VIRTUALIZATION
[email protected]
Chapter 4- agenda
◦ Boot, reboot, and shut down a system normally
◦ Boot systems into different targets manually
◦ Interrupt the boot process in order to gain access
to a system
◦ Identify CPU/memory intensive processes and kill
processes
◦ Locate and interpret system log files and journals
◦ Preserve system journals
◦ Start, stop, and check the status of network
services
SHUTTING DOWN, SUSPENDING,
AND HIBERNATING THE SYSTEM

Old Command New Command Description

halt systemctl halt Halts the system.
Powers off the
poweroff systemctl poweroff
system.
reboot systemctl reboot Restarts the system.
Suspends the
pm-suspend systemctl suspend
system.
Hibernates the
pm-hibernate systemctl hibernate
system.
systemctl hybrid- Hibernates and
pm-suspend-hybrid
sleep suspends the system.
Boot systems into different
targets manually
 Previous versions of Red Hat Enterprise Linux, which were distributed
with SysV init or Upstart, implemented a predefined set of runlevels
that represented specific modes of operation. These runlevels were
numbered from 0 to 6 and were defined by a selection of system
services to be run when a particular runlevel was enabled by the
system administrator. In Red Hat Enterprise Linux 7, the concept of
runlevels has been replaced with systemd targets. Systemd targets
are represented by target units. Target units end with the .target file
extension and their only purpose is to group together other systemd
units through a chain of dependencies. For example, the
graphical.target unit, which is used to start a graphical session, starts
system services such as the GNOME Display Manager (gdm.service)
or Accounts Service (accounts-daemon.service) and also activates the
multi-user.target unit. Similarly, the multi-user.target unit starts other
essential system services such as NetworkManager
(NetworkManager.service) or D-Bus (dbus.service) and activates
another target unit named basic.target.
Comparison of SysV Runlevels with systemd Targets

Runlevel Target Units Description

Shut down and
runlevel0.target,
0 power off the
poweroff.target
system.
runlevel1.target,
1 Set up a rescue shell.
rescue.target
Set up a non-
runlevel2.target,
2 graphical multi-user
multi-user.target
system.
Set up a non-
runlevel3.target,
3 graphical multi-user
multi-user.target
system.
Set up a non-
runlevel4.target,
4 graphical multi-user
multi-user.target
system.
runlevel5.target, Set up a graphical
5
graphical.target multi-user system.
runlevel6.target, Shut down and
6
reboot.target reboot the system.
 Changing the Current Target

 To change to a different target unit in the current

session, type the following at a shell prompt as
root:
 systemctl isolate name.target
 This command starts the target unit named name
and all dependent units, and immediately stops
all others.
 To turn off the graphical user interface and
change to the multi-user.target unit in the current
session, run the following command as root:
 ~]# systemctl isolate multi-user.target
 Changing to Rescue Mode

 Rescue mode provides a convenient single-user

environment and allows you to repair your system in
situations when it is unable to complete a regular
booting process. In rescue mode, the system attempts
to mount all local file systems and start some important
system services, but it does not activate network
interfaces or allow more users to be logged into the
system at the same time. In Red Hat Enterprise Linux 7,
rescue mode is equivalent to single user mode and
requires the root password.
 To change the current target and enter rescue mode in
the current session, type the following at a shell prompt
as root:
 systemctl rescue
 Changing to Emergency Mode
 Emergency mode provides the most minimal
environment possible and allows you to repair your
system even in situations when the system is unable to
enter rescue mode. In emergency mode, the system
mounts the root file system only for reading, does not
attempt to mount any other local file systems, does not
activate network interfaces, and only starts few
essential services. In Red Hat Enterprise Linux 7,
emergency mode requires the root password.
 To change the current target and enter emergency
mode, type the following at a shell prompt as root:
 systemctl emergency
 This command is similar to systemctl isolate
emergency.target, but it also sends an informative
message to all users that are currently logged into the
system.
Interrupt the boot process in order to gain access to a
system
 First, you need console access: Either at a keyboard and
monitor locally, or via Virtual Machine remote console, you will
need to see and interact with the bootloader.

 Reboot the machine: As soon as the bootloader comes up with

the selection screen, quickly tap the up and down arrows up
and down to pause the countdown.

 Select the kernel you want to boot into, and hit 'e': This will
take you into a screen where you can edit the grub bootloader
script.

 Find the line that refers to the kernel: There will be a series of
'boot parameters' here: these are instructions passed during
the loading of the kernel.
 Resetting the Root Password

 For RHEL/CentOS 7, the line starts with 'linux16'.

 For RHEL/Centos 8x, and Fedora the line starts with 'linux'.
 Add 'rd.break' at the end of that line (There are other things you can do
here, but for now, this is all you need) [ Note: This change is
temporary ].

 Now hit Ctrl-x to run the edited bootloader script.

 You’ll boot to a 'rescue' prompt that looks like this: switch_root:/#.

 Remount the root partition in read-write mode so that you can run
commands. Enter the following: mount -o remount rw /sysroot and then
hit ENTER.

 Now type chroot /sysroot and hit enter. This will change you into the
sysroot (/) directory, and make that your path for executing commands.
 Resetting the Root Password

 Now you can simply change the password for root using the passwd
command.

 Next, before you reboot, you will need to make sure that SELinux
allows the file changes. At the prompt ,enter: touch /.autorelabel.
This will signal SELinux on the next reboot that the filesystem has
changed (the changed password) and allow the change to be
loaded. This will cause the whole filesystem to be 'relabeled' which
might take a while, depending on the size of the filesystem and the
speed of the machine, so be aware of this possibility.

 Type exit to leave the chroot environment and enter reboot.

 Go and make a cup of tea to reward yourself for your cleverness:

The water should be boiling now. (Again, optional but recommended
and highly dependent on your participation with Step #1.)
Identify CPU/memory intensive processes, adjust process
priority with renice, and kill processes
 To get an instantaneous image of a server activity
(use ‘virt-top‘ on a KVM hypervisor), type:
 # top
 To get details about processes, type:
 # ps –edf
 To kill the process, get its PID through top or ps
(here 789) and type:
 # kill -9 789
 Alternatively:
 # pkill script.sh
 To show network card activities, type:
 # netstat -i
 Locate and interpret system log files and journals

 Most of system log files are located

in the /var/log directory due to
SYSLOG default configuration (see
/etc/rsyslog.conf file).
 In addition, all SELinux events are

written into the

/var/log/audit/audit.log file.
 With Systemd, new commands have

been created to analyse logs at boot

time and later.
 Locate and interpret system log files and journals

 In addition, Systemd handles the

system event log, a syslog daemon is
not mandatory any more. To get the
content of the Systemd journal, type:
 # journalctl
 To get all the events related to the

crond process in the journal, type:

 # journalctl /sbin/crond
 Locate and interpret system log files and journals

 To get all the events since the last

boot, type:
 # journalctl –b
 To get all the events that appeared

today in the journal, type:

 # journalctl --since=today
 To get all the events with a syslog

priority of err, type:

 # journalctl -p err
 Linux Services (Networking Services)
 A service (also called a daemon process) is

software that runs on a computer,

generally in the background. This is
usually because it's something that the
administrator isn't likely to interact with
directly.
 For instance, a network service runs at

the application layer to provide some form

of service over a network. It's expected
that client computers will contact the
service for access. A common example is
the Apache web server. It runs on a
system so that devices connected to the
internet can view a specific set of files on
 Start a service

 To start a given service, use:

 $ sudo systemctl start <service>
 For example, to start the sshd service,

type:
 $ sudo systemctl start sshd.service
 You can ignore .service and run the

systemctl start sshd command

 List services

 You can list all loaded services on a server with:

 $ sudo systemctl list-units --type=service
 Stop a service
 To stop a service, type:
 $ sudo systemctl stop sshd
 To find out whether a service is running, inactive, enabled,
disabled, or has exited, use:
 $ sudo systemctl status sshd
 The systemctl command also has is-active and is-enabled
options to see whether a service is active or enabled. For
example, to check if a service is active or enabled, run:
 $ systemctl is-active sshd
 This command gives two possible outputs. The service is
either active, which means it is running, or it's inactive,
which means it is stopped or not running.
 Enable a service

 You can configure a service to start automatically with the

system so that you don't have to start it manually after the
server reboots or restarts.
 To enable a service, which means the service starts
automatically when the server boots, use:
 $ sudo systemctl enable sshd
 To both start and enable a service, add the --now option,
like this:

 $ sudo systemctl enable --now sshd

 To check whether a service is enabled, enter:

 $ sudo systemctl is-enabled sshd

 When a service is enabled, it starts automatically at boot.
When it's disabled, it doesn't start automatically at boot.
 Disable a service

 To disable a service, so the service will not start

automatically at boot time, run:

 $ sudo systemctl disable sshd

Questions?