BECOME FAMILIAR WITH RUNLEVELS

Linux systems typically use seven different runlevels, which define what services should be running on the system. The init process uses these runlevels to start and stop the computer.

Runlevel 0 signifies that the computer has completely shut down, and runlevel 1 (or S) represents single-user mode. Runlevels 2 through 5 are multiuser modes, and runlevel 6 is the "reboot" level. Different Linux variations may not use all runlevels, but typically, runlevel 2 is multiuser text without NFS, runlevel 3 is multiuser text, and runlevel 5 is multiuser GUI.

Each runlevel has its own directory that defines which services start and in what order. You'll typically find these directories at /etc/rc.d/rc?.d, where ? is a number from 0 through 6 that corresponds to the runlevel. Inside each directory are symlinks that point to master initscripts found in /etc/init.d or /etc/rc.d/init.d.

These symlinks have a special format. For instance, S12syslog is a symlink that points to /etc/init.d/syslog, the initscript that handles the syslog service. The S in the name tells init to execute the script with the "start" parameter when starting that runlevel. Likewise, there may be another symlink pointing to the same initscript with the name K88syslog; init would execute this script with the "stop" parameter when exiting the runlevel.

The number following the S or K determines the order in which init should start or stop the service in relation to other services. You can see by the numbers associated with the syslog service that syslog starts fairly early in the boot process, but it stops late in the shutdown process. This is so syslog can log as much information about other services starting and stopping as possible.

Because these are all symlinks, it's easy to manipulate the order in which init starts services by naming symlinks accordingly. It's also easy to add in new services by symlinking to the master initscript.