If you’ve ever watched a Linux computer boot up you’ve probably noticed a number of stages to it and different screens. Though a lot of distributions now hide the more complex parts behind a splash screen, you can usually hit the arrow keys to hide that screen and see the wall of text scrolling by.

So here’s a blow by blow account of what the computer is doing while Linux is starting up.

The Boot Loader

The boot loader is the first stage you’ll encounter after the computer’s BIOS finishes its job.  The most common boot loader now is GRUB, and chances are you’ll see a screen with a GRUB title and an option list of the possible operating systems to load if you have a system with more than one operating system, or multiple versions of one Linux distribution if it has been updated a lot.

Wind the clock back a decade and most systems would have been booting with LILO, a different screen layout, but achieving mostly the same thing. Another commonly seen bootloader is ISOLINUX and it’s what you will encounter on most live CD/DVDs when they boot.

The purpose of this boot loader is to start loading the Linux Kernel (the core of the Linux operating system), and pass over to it any information it will need to boot. This is generally the location of the root (/) partition along with a number of flags for modules that may need loading to boot.

Most desktop bootloaders allow for multiple options so that when a system update installs a newer kernel, if that causes instability to the system or stops it booting, you can select to boot from the previous option.

Boot loader failures generally occur when there is a disk issue causing the boot loader to be unable to locate the files needed to load or to start the operating system, at which point the boot loader will either die unceremoniously leaving you with a non-responsive system or with luck, drop you to a boot loader command prompt from which you can attempt to boot the system, either way the system won’t complete booting without help.

Kernel First Stage

The boot loader generally uses a compressed kernel image to boot the system. This is generally a very fast process, and unless the system hangs here you are unlikely to be able to read any relevant lines of text. For example, Debian swiftly flashes the text:

Loading Linux <kernel version> …

Loading initial ramdisk …

After which the screen clears and the text “Loading, please wait… ” is seen. Once this initial stage is loaded the system prepares CPU and memory systems as well as finding relevant information on the disks, then hands off to the kernel on the root file system and the Init process begins.

Init Process

The init process is the start of everything running on the system. Configuration for it is stored in /etc/inittab which tells the system the default run level to boot to, what to do if single user mode is requested, what to do if CTRL-ALT-DEL is pressed, etc.

The init process will then start launching the other processes required to start the system in its configuration. Things to look out for in the early stages are things like the detection of hardware and loading of device drivers, creating the device map in /dev and initialising swap.  Then the system will perform any required fsck checks on disks. If the system requires an interactive fsck to repair problems, this is the stage that booting will stop at.

Once the disks are checked the system can safely mount the filesystems in read-write mode ready for use. Then it is safe to start initiating other devices and initialising systems such as networking. At this point each task being performed is generally prefixed or postfixed by a result in square brackets, usually ” [ ok ] ” to indicate how the task completed. The system continues by loading the various daemons that are configured to be loaded at bootup, eg services such as ACPI, cron, sshd, apache, and so on. There are a few things that can cause the boot process to halt here, an often seen one is the requirement for SSL certificate passphrases to be entered when apache boots, and the system will dutifully wait for the passphrase to be entered before continuing, something worth noting if you are running apache with SSL certificates.

Init is something that remains running during the whole time the system is up, so it doesn’t end until the system completes shutdown. Although init’s visible activity in the boot process ends when the system presents the login prompt for a user to begin using the system.

As stated, there are a few events that can occur that will prevent a rebooted system from coming back online and if you are aware of them you can check in advance for issues that may prevent a clean reboot before issuing the reboot itself, potentially saving the time that may be spent issuing a support ticket to get the server back online.