3. Init is the granddaddy of them all

All processes are spawned by init, or by processes whose ancestor is init. Period!

Great. So how the heck does init know what to do?

When init starts up at boot time it looks in /etc/inittab for instructions. In my /etc/inittab, for example, the first non-comment is
which tells init that until another runlevel is specified, wake up using 'runlevel 2' by default.

But even before the runlevel-specific stuff is executed, the 'system-wide gotta-have' stuff is specified in /etc/inittab via
which runs all the initial stuff, like loading kernel modules, mounting partitions, hardware clock settings, yada yada... What the /etc/init.d/rcS script does (go have a look at yours, I'll wait) is run all the scripts in /etc/rcS.d/S* to get all your basic system features up and running before delving into the items specific to each runlevel. For example, you might need network cards and SCSI drivers up-and-at-em – but you don't need any SQL engines or webservers until you're entering runlevel (pick one, for example) four.

Whenever you boot into single-user mode (also called 'runlevel S') init runs only rcS stuff and doesn't continue any further – enabling you to log in as root and twiddle with your settings, before starting a services-oriented runlevel. (By services-oriented, I mean something like "on runlevel A we've got X and apache and nfs available; on runlevel B we have only sshd with logins restricted to group XYZ only; on runlevel C we have nfs and ftp ...")

3.1. But how about the feature-sets for a "user runlevel"?

For the runlevel-specific stuff (and this is what determines the difference between runlevel 3 and 5 and 2 and ...) further down in /etc/inittab there's
l2:2:wait:/etc/init.d/rc 2
which says that for runlevel 2, to run the /etc/init.d/rc script with argument 2. That's the script that you'll find that does most of the work. Go check it out.

Anyhow, what the /etc/init.d/rc script does is look in
for scripts to run. A very nice, modular structure. And all those /etc/rc*.d/* items are just symlinks to the actual scripts in /etc/init.d/ anyhow.

3.2. What makes init start up a login sequence?

Even further down in /etc/inittab is the procedure for establishing a live tty connection, which enables you to log in in the first place:

1:2345:respawn:/sbin/getty 38400 tty1
2:23:respawn:/sbin/getty 38400 tty2
3:23:respawn:/sbin/getty 38400 tty3
4:23:respawn:/sbin/getty 38400 tty4
5:23:respawn:/sbin/getty 38400 tty5
6:23:respawn:/sbin/getty 38400 tty6

According to this, for runlevels 4 and 5, only tty1 will be active; for 2 and 3 tty[1-6] will all be active. (It's actually more sensible to say that tty1 is gonna be active for runlevels 2-5, and tty[2-6] will be active only for runlevels 2-3.) And when the connection goes down (either you log out in a nice, neighborly fashion, or you get rudely disconnected by a power failure or because your neice chewed through your modem cable), init knows to 'respawn' the process for the next victim. Cool, eh?

3.3. What runlevel am I in?

How do you find out which runlevel you're in right now? This one's easy. Try this:

$ /etc/runlevel
S 2

It displays both the previous runlevel (which may be S after a successful system startup, or perhaps N, signifying that there was no previous runlevel) and the current runlevel. (My system is at runlevel 2 after last being at the single-user [S] runlevel.) Nothing to it.

3.4. Changing to a different runlevel

This is not something to do lightly, especially if you have several users on your system. They'll track you down eventually (and have been known to use weapons) and you'll regret your careless act unless you have a good reason...

If it's really a good idea to do so, here's the recommended way to change from whatever runlevel you're using, to another runlevel:

# telinit 4
# telinit S
# telinit 2

Very simple. Just telinit (as root) which runlevel to switch to, and you're off!

3.5. How do the runlevels differ?

Sorry, I can't answer that... But you can.

Remember the /etc/inittab section that showed what to do on each runlevel?

l0:0:wait:/etc/init.d/rc 0
l1:1:wait:/etc/init.d/rc 1
l2:2:wait:/etc/init.d/rc 2
l3:3:wait:/etc/init.d/rc 3
l4:4:wait:/etc/init.d/rc 4
l5:5:wait:/etc/init.d/rc 5
l6:6:wait:/etc/init.d/rc 6

They all run the same script -- /etc/init.d/rc ! The very only single difference is, which argument is sent to that script.

So we hafta check into that script to see what the argument does.

If you look at the /etc/init.d/rc script, you'll find portions that look something like this:

# Is there an rc directory for this new runlevel?
if [ -d /etc/rc$runlevel.d ]
	for i in /etc/rc$runlevel.d/K[0-9][0-9]*
	for i in /etc/rc$runlevel.d/S*

Can you see what that does? If you enter runlevel 3 (perhaps via telinit 3 ) it'll try running scripts from /etc/rc3.d/*. Mystery solved.

When entering a runlevel, you may need to "turn off" features that might have been turned on by another runlevel. Then, you turn on the features for the new runlevel.

So first, /etc/init.d/rc will run all the "kill" scripts (any script whose name starts with "K") in the new run level with a "stop" argument. For example:

/etc/rc3.d/K20postgresql stop
Which stops the pgsql server for runlevel 3

After it's all done running available "kill" scripts it then runs the "start" scripts (which have names staring with "S") in much the same way:

/etc/rc3.d/S60sshd start
Which launches the secure shell daemon for runlevel 3.

So now you should see why YOU can answer the question better than I can: only YOU can determine the difference between your runlevels ... by looking at your /etc/inittab file and by checking out the /etc/rc*.d/* scripts!

And note that the scripts will be run "in sequential order" meaning that S10* would run before S60* and so forth. This is how you can ensure that the load order works properly. For example, you may need to establish a network connection with a fileserver before launching a remote-log daemon.

BUT! There are certain preset runlevels that have important meanings: