Loading...

VONDS ©

Lab 8: Identify and Change Default Runlevel

Back to Lab Index

Identify the current SysV runlevel and validate runlevel state using CLI-only inspection. Switch to runlevel 3 at runtime, then confirm where the default runlevel is defined so the change persists across boots.

boot services troubleshooting

Scenario

You are working on an older Debian system using SysV init. The system boots into a graphical environment, but your team needs it to boot into multi-user mode without a GUI (runlevel 3) for headless operation and reduced boot complexity.

Operator context

This is the kind of change you make when the GUI adds boot time, introduces unnecessary dependencies, or complicates recovery. Validate the runtime transition first, then commit the persistent configuration change.

Objective

  • Identify the current runlevel.
  • Verify runlevel state using more than one command.
  • Inspect runlevel 3 service ordering via rc symlinks.
  • Switch to runlevel 3 during runtime.
  • Locate the configuration responsible for the default runlevel.
  • Switch back to graphical mode (runlevel 5).

Concepts

  • Runlevels are operational modes that determine which services should be started or stopped.
  • Runtime changes (init 3) alter the current state only; persistent changes require updating the system’s default runlevel configuration.
  • SysV runlevel directories (for example /etc/rc3.d) contain S## and K## symlinks that control start/stop ordering.
  • /etc/inittab defines the default runlevel via the initdefault entry on systems using classic SysV init.
  • Many modern systems provide SysV-compatible commands while actually using systemd. Verify assumptions when files like /etc/inittab are missing.

Walkthrough

Step 1: Show the current runlevel.
Command 
runlevel

runlevel prints two fields: the previous runlevel and the current runlevel. A previous runlevel of N typically means this is the first runlevel after boot. 

N 5
Step 2: Confirm runlevel using an alternate command.
Command 
who -r

who -r provides a second source of truth and includes when the current runlevel was entered, which can be useful for operational notes and incident timelines. 

run-level 5  2025-07-18 13:14
Step 3: Inspect runlevel 3 service links.
Command 
ls /etc/rc3.d/

Runlevel directories contain symlinks that control service ordering. S## entries are started when entering the runlevel, and K## entries are stopped. The numbers define ordering. 

S01rsyslog  S02networking  S03cron  K01gdm3
Step 4: Switch to runlevel 3 immediately.
Command 
init 3
Alternative 
telinit 3

This performs a runtime transition into multi-user mode without the GUI. On real systems, be careful: runlevel changes can stop services that impact remote access depending on how the rc symlinks are defined. 

Switching to runlevel 3...
[ OK ] Stopping graphical interface manager
[ OK ] Starting multi-user services
Step 5: Identify where the default runlevel is configured.
Command 
grep -E '^[[:space:]]*id:.*:initdefault:' /etc/inittab

On SysV init systems, the default runlevel is defined by the initdefault entry in /etc/inittab. This is what determines the runlevel after a reboot. 

# The default runlevel.
id:3:initdefault:
Step 6: Return to graphical mode (runlevel 5).
Command 
init 5
Alternative 
telinit 5
Switching to runlevel 5...
[ OK ] Starting graphical interface manager

Common breakpoints

/etc/inittab not found

Many systems are systemd-based even when SysV commands exist. Confirm the init system before assuming runlevel persistence is controlled by /etc/inittab. A quick check is ps -p 1 -o comm= and verifying whether PID 1 is init or systemd.

Remote session drops after switching runlevels

If networking or SSH is tied to runlevel-specific symlinks, a runlevel change can stop remote access. Always validate rc directory contents and service ordering before making changes on remote systems.

Runlevel 3 does not behave as expected

Runlevel meanings vary by distribution and configuration. Use rc directory contents as the source of truth for what starts and stops in that runlevel.

Cleanup checklist

This lab does not change configuration unless you edit /etc/inittab. Ensure the system is returned to the expected runlevel (typically 5 for this scenario) and confirm the active runlevel.

Commands 
runlevel
who -r
Success signal

Both commands agree on the current runlevel and the system is in the intended operational mode for the environment.

Reference

  • runlevel: Shows previous and current SysV runlevel.
    • Output format: <previous> <current> (example: N 5).
    • N typically indicates the first runlevel after boot.
    • Useful as a fast confirmation of the system’s current mode.
  • who -r: Displays current runlevel and when it was entered.
    • -r: Instructs who to print the system’s current runlevel record
  • ls /etc/rc3.d/: Lists SysV service symlinks for runlevel 3.
  • init <N> / telinit <N>: Switches runlevels immediately.
  • /etc/inittab: SysV init configuration file for default runlevel.
  • Common runlevel meanings (verify per distro/config):
    • 0: Halt / power off
    • 1: Single-user / rescue
    • 2: Multi-user (varies)
    • 3: Multi-user, no GUI (common mapping)
    • 5: Multi-user with GUI
    • 6: Reboot