Read the boot you just had

short · 15 min · Objective 1.1

An interactive version of this lab runs a real Linux machine in your browser. It needs JavaScript; the written steps below work on any Linux machine.

Task

Establish, from the running system alone, which firmware mode it booted in, which kernel it is running, what the initramfs contains, and what the bootloader was told to do. These are the four facts you need before you can diagnose a machine that will not boot -- and the time to learn where they live is while everything works.

Steps

  1. Determine the firmware mode. ls /sys/firmware/efi succeeds only under UEFI; on a legacy BIOS boot the directory does not exist.
  2. Read the running kernel with uname -r, then list what else is installed with ls /boot/vmlinuz-*. Note whether you could fall back to an older one.
  3. Look inside the initramfs for the current kernel: lsinitrd /boot/initramfs-$(uname -r).img | head -40 on RHEL, or lsinitramfs /boot/initrd.img-$(uname -r) | head -40 on Debian. Find the storage driver your root filesystem needs.
  4. Read the kernel command line the bootloader actually passed, with cat /proc/cmdline. Identify the root= argument and compare it with findmnt /.
  5. Read the first forty lines of this boot's kernel messages with journalctl -k -b | head -40, and find the moment the root filesystem was mounted.

Verify

# firmware mode, kernel, and the root the bootloader was told to use
[ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
uname -r
grep -o 'root=[^ ]*' /proc/cmdline
findmnt -n -o SOURCE,FSTYPE,UUID /

The root= value and the device findmnt reports for / must describe the same filesystem. On an LVM install -- the RHEL default -- both say /dev/mapper/...; on a plain partition root= is usually UUID=... while findmnt shows a device path, and its UUID column is what joins them. If you cannot explain how one resolves to the other, that is the thing to chase.

Notes

/proc/cmdline is the single most useful file when a machine boots wrongly: it is what the bootloader passed, not what the configuration says it should have passed. The two differ whenever somebody edited grub.cfg by hand and a regeneration discarded it.

This is an independent study companion for CompTIA Linux+ and is not produced by or endorsed by CompTIA.