ExamFinch.com My Study

Study guide

2.4 Kernel Initialization, Initramfs & System Logs (101.2)

Practice this exam

LPIC-1 Linux Administrator — Exam 101 101-500

Track your progress as you read

Finished sections get a check mark.

1 Exam Overview & Study Strategy

1.1 LPIC-1 101-500 Exam Structure & Blueprint 1.2 Command Line & Shell Fundamentals for Exam Success 1.3 Fill-in-the-Blank Strategies & Common Traps

2 Topic 101: System Architecture

2.1 Hardware Discovery, Sysfs, Procfs & Kernel Modules (101.1) 2.2 Udev, Dbus & Device Management (101.1) 2.3 BIOS vs. UEFI & System Boot Process (101.2) 2.4 Kernel Initialization, Initramfs & System Logs (101.2) 2.5 Systemd Boot Targets & Unit Management (101.3) 2.6 SysVinit Runlevels, Telinit & System Shutdown (101.3)

3 Topic 102: Linux Installation & Boot Management

3.1 Hard Disk Layout, Partition Schemes & Swap Design (102.1) 3.2 LVM & Standard Mount Point Allocation (102.1) 3.3 GRUB 2 Configuration & Troubleshooting (102.2) 3.4 Legacy GRUB & Alternative Boot Loaders (102.2) 3.5 Managing Shared Libraries & ldconfig (102.3) 3.6 Linux as a Virtualization Guest & Cloud Instances (102.6)

4 Topic 102: Package Management Systems

4.1 Debian Low-Level Package Management with dpkg (102.4) 4.2 High-Level Debian Package Management: apt, apt-get & apt-cache (102.4) 4.3 RPM Package Management with rpm (102.5) 4.4 YUM, DNF & Zypper Package Management (102.5) 4.5 Package Repositories & Integrity Verification (102.4/102.5) 4.6 Universal Linux Packages: Snap, Flatpak & AppImage (102.4/102.5)

5 Topic 103: Command Line & Text Processing

5.1 Shell Environment, Environment Variables & Aliases (103.1) 5.2 Command History, Quoting & Expansion (103.1) 5.3 Basic Text Filters: cat, head, tail, cut, paste, nl, od (103.2) 5.4 Advanced Text Filters: sort, uniq, wc, tr, split, less & Checksums (103.2) 5.5 Stream Editing with sed (103.2) 5.6 Basic File Management: cp, mv, rm, touch, mkdir, rmdir (103.3) 5.7 Archiving and Compression: tar, gzip, bzip2, xz, cpio & dd (103.3)

6 Topic 103: Streams, Processes, Regex & Vi

6.1 Standard Streams, Redirection & File Descriptors (103.4) 6.2 Pipelines, tee & xargs (103.4) 6.3 Process Monitoring: ps, top, free, watch, pgrep, pstree & uptime (103.5) 6.4 Signals, kill, Job Control, nohup, screen & tmux (103.5) 6.5 Process Priorities: nice & renice (103.6) 6.6 Regular Expressions & grep, egrep, fgrep (103.7) 6.7 vi / vim Modes, plus nano, Emacs & EDITOR Awareness (103.8)

7 Topic 104: Devices, Partitions & Filesystems

7.1 Block Devices, fdisk & gdisk (104.1) 7.2 GNU Parted & Partition Table Management (104.1) 7.3 Creating Filesystems: mkfs, ext4, XFS, VFAT/exFAT & Btrfs (104.1) 7.4 Filesystem Integrity: fsck, e2fsck, xfs_repair, xfs_fsr & xfs_db (104.2) 7.5 Monitoring Disk Usage: df, du & tune2fs (104.2) 7.6 Managing Swap Space: mkswap, swapon & swapoff (104.1/104.2)

8 Topic 104: Mounts, Permissions, Links & FHS

8.1 Mounting and Unmounting Filesystems: mount & umount (104.3) 8.2 Persistent Mounts: /etc/fstab, UUIDs & systemd mount units (104.3) 8.3 Standard File Permissions: chmod, chown, chgrp & umask (104.5) 8.4 Special Permissions: SUID, SGID & Sticky Bit (104.5) 8.5 Hard Links vs. Symbolic Links: ln & Inodes (104.6) 8.6 Filesystem Hierarchy Standard (FHS) & File Location (104.7)

2.4 Kernel Initialization, Initramfs & System Logs (101.2)

Key Takeaways Explain This Topic AI

vmlinuz is the compressed Linux kernel executable loaded into memory; it deprobes hardware and executes /init inside the initramfs.

Initramfs (Initial RAM Filesystem) is a gzipped cpio archive providing userspace drivers (RAID, LVM, NVMe, LUKS) needed to mount the real root filesystem (/); created via dracut, mkinitrd, or update-initramfs.

Kernel parameters in /proc/cmdline customize boot behavior (e.g., root=UUID=..., ro, init=/bin/bash for password recovery, systemd.unit=..., quiet, splash).

dmesg reads the in-memory kernel ring buffer (-T for human-readable timestamps, -l for severity filtering, -w to follow live output), while persistent logs live under /var/log/ and in journalctl (-k for kernel messages, -b for the current boot, -b -1 for the previous boot).

Objective 101.2 requires awareness of three init systems: SysVinit (sequential /etc/init.d scripts), Upstart (event-driven jobs in /etc/init/, controlled with initctl), and systemd (parallel units controlled with systemctl).

Last updated: August 2026

2.4 Kernel Initialization, Initramfs & System Logs

Quick Summary: Once loaded by the bootloader, the compressed kernel ( vmlinuz ) initializes core hardware and unpacks the initramfs (Initial RAM Filesystem). The initramfs provides a temporary root environment containing storage, filesystem, and encryption drivers required to locate and mount the real root filesystem ( / ). Administrators pass boot options to the kernel via command-line arguments (visible in /proc/cmdline ), troubleshoot early boot errors using dmesg to view the kernel ring buffer, and analyze system event histories using journalctl and /var/log/ .

1. Kernel Decompression & Early Initialization

The Linux kernel file in /boot is named vmlinuz-<version> . The leading v stands for "virtual memory," and the trailing z indicates that the kernel binary is compressed (using gzip, xz, or zstd).

Kernel Boot Sequence

Self-Decompression : The bootloader loads vmlinuz into physical RAM. A small embedded decompressor program uncompresses the kernel code into high memory and jumps to the kernel entry point.

CPU Mode Setup : The kernel switches the processor from real mode/32-bit mode into 64-bit long mode with paging enabled.

Hardware Subsystem Probing : The kernel parses ACPI tables, probes system timers, detects available RAM, and initializes CPU symmetric multiprocessing (SMP).

Initramfs Extraction : The kernel creates a tmpfs RAM filesystem in memory and extracts the initial ramdisk archive ( initramfs ) into it.

Executing /init : The kernel spawns its first user-space process inside the RAM disk: /init .

  • 2. Initramfs vs. Initrd: The Root Mounting Problem
  • The Problem It Solves

A modern Linux installation frequently places the root filesystem on complex storage configurations:

  • Hardware RAID or Software RAID ( mdadm )
  • Logical Volume Manager ( LVM )
  • NVMe or multipath SAN storage
  • LUKS full-disk encryption ( cryptsetup )
  • Network storage ( iSCSI or NFS )

If the drivers for these storage layers were compiled as loadable kernel modules ( .ko ), the kernel could not load them because they reside in /lib/modules/ on the very root filesystem the kernel cannot yet read. Compiling every conceivable driver statically into the kernel would produce an enormous, inefficient binary.

The Solution: Initramfs

The initramfs is a compressed cpio archive containing a minimal user-space root environment (busybox/systemd utilities, required .ko kernel modules, and initialization scripts). [Bootloader] ──► Loads vmlinuz + initramfs into RAM

  • │
  • ▼
  • [Kernel] ──────► Mounts tmpfs in RAM & unpacks initramfs cpio archive
  • │
  • ▼
  • [/init Script] ─► 1. Load NVMe / LVM / RAID / LUKS modules
  • 2. Unlock encrypted volume (prompt password)
  • 3. Scan LVM volume groups (vgscan / vgchange)
  • 4. Mount real root disk read-only at /sysroot
  • 5. Execute switch_root /sysroot /sbin/init
  • │
  • ▼
  • [Real System] ──► systemd takes over PID 1 on real root filesystem (/)
  • Feature Legacy Initrd (Initial Ramdisk) Modern Initramfs (Initial RAM Filesystem)
  • Data Structure Block device image formatted with ext2/minix cpio archive unpacked into memory
  • Memory Mechanism Fixed-size RAM disk (consumes buffer cache) tmpfs (dynamically grows and shrinks in RAM)
  • Root Transition Uses legacy pivot_root system call Uses switch_root (recursively cleans RAM disk)
  • Inspection Tool Loopback mount lsinitramfs (Debian) or lsinitrd (RHEL)
  • Generating the Initramfs Image
  • Red Hat / Fedora / SUSE : dracut (modern) or legacy mkinitrd # Rebuild initramfs for current kernel
  • sudo dracut -f
  • # Rebuild initramfs for a specific kernel version
  • sudo dracut -f /boot/initramfs-5.15.0-88-generic.img 5.15.0-88-generic
  • Debian / Ubuntu : update-initramfs or mkinitramfs # Update the initramfs for the currently running kernel
  • sudo update-initramfs -u
  • # Generate initramfs for all installed kernels
  • sudo update-initramfs -c -k all

3. Kernel Command-Line Parameters

Kernel parameters (also called boot arguments) are strings passed from the bootloader (GRUB 2) to the kernel at boot. The active parameters for the running system are stored in plaintext in /proc/cmdline . $ cat /proc/cmdline

BOOT_IMAGE=/vmlinuz-5.15.0-88-generic root=UUID=c3a4d5e6-7890-4abc-9def-1234567890ab ro quiet splash systemd.unit=multi-user.target

Essential Kernel Parameters for LPIC-1

Parameter Syntax Technical Purpose & Exam Relevance

root=UUID=<uuid> ; root=/dev/sda2 Specifies the location of the real root filesystem device. Specifying by UUID is preferred over /dev/sdX to prevent device reordering issues.

ro Mounts the real root filesystem read-only initially, allowing fsck to safely verify filesystem integrity before remounting read-write.

rw Mounts the root filesystem read-write immediately (used in troubleshooting).

init=/bin/bash ; init=/bin/sh Bypasses the standard init daemon and launches a root shell directly. Used for emergency password recovery and fixing broken init systems.

systemd.unit=<target> Instructs systemd to boot directly into a specific target (e.g., systemd.unit=rescue.target , systemd.unit=multi-user.target ).

single , 1 , s , S Boots into SysVinit single-user maintenance mode (maps to rescue.target under systemd).

emergency Boots systemd into emergency.target (root mounted read-only, no network).

quiet Suppresses informational kernel console messages during boot.

splash / rhgb Enables graphical boot splash animation (Plymouth / Red Hat Graphical Boot).

nomodeset Disables Kernel Mode Setting (KMS), falling back to generic VESA video modes for GPU troubleshooting.

selinux=0 / enforcing=0 Completely disables SELinux or sets it to permissive mode.

console=ttyS0,115200 Directs kernel console output to a serial port for headless/cloud instances.

4. Inspecting the Kernel Ring Buffer: dmesg

During early boot, before logging daemons ( rsyslogd or systemd-journald ) have started, the kernel stores all system log messages, hardware probe results, and driver errors in an internal memory structure called the Kernel Ring Buffer .

Characteristics of the Ring Buffer

Stored in kernel RAM; fixed size (e.g., 512 KiB to 8 MiB).

As new messages arrive after the buffer fills, the oldest messages are overwritten (circular FIFO).

Accessible via the device node /dev/kmsg or the /proc/kmsg interface.

  • The dmesg Command
  • dmesg dumps the contents of the kernel ring buffer to standard output. # Standard dmesg snippet
  • $ dmesg

[ 0.000000] Linux version 5.15.0-88-generic (buildd@lcy02) ...

  • [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-5.15.0-88-generic root=UUID=... ro quiet
  • [ 1.245892] e1000e: Intel(R) PRO/1000 Network Driver
  • [ 1.245910] e1000e 0000:00:1f.6 eth0: (PCI Express:2.5GT/s:Width x1) 00:15:5d:01:23:45
  • [ 2.102319] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null)
  • Crucial dmesg Command-Line Flags

-T , --ctime : Converts monotonic timestamps (seconds since boot like [ 1.245892] ) into human-readable real-world date and time strings (e.g., [Sat Aug 29 19:30:15 2026] ).

-l <level> , --level=<level> : Filters messages by comma-separated severity levels:

emerg (0), alert (1), crit (2), err (3), warn (4), notice (5), info (6), debug (7). # Display only critical and error messages

dmesg -l err,crit

-w , --follow : Waits for and displays new kernel messages in real time (similar to tail -f ).

-c : Prints the ring buffer contents and then immediately clears the buffer.

-C : Clears the ring buffer without printing (requires root privileges).

-H , --human : Enables human-readable output with auto-paging, colorization, and relative time deltas.

5. System Log Files & journalctl

Once the operating system is booted, kernel messages and user-space service events are captured by system loggers.

Traditional Log Files in /var/log/

/var/log/dmesg (or /var/log/boot.log ): Snapshot of the kernel ring buffer captured during the boot sequence.

/var/log/messages : General system activity log used by RHEL, CentOS, and SUSE.

/var/log/syslog : General system activity log used by Debian and Ubuntu.

/var/log/kern.log : Dedicated kernel message log in Debian/Ubuntu systems.

Querying Boot Logs with journalctl

On systemd -based systems, systemd-journald captures binary log streams from the kernel, stdout/stderr of services, and syslog calls. # Display only kernel messages (equivalent to dmesg)

  • $ journalctl -k
  • # or
  • $ journalctl --dmesg
  • # View logs from the current boot session
  • $ journalctl -b
  • # View logs from the previous boot session (requires persistent /var/log/journal)
  • $ journalctl -b -1
  • # View logs from two boots ago
  • $ journalctl -b -2
  • # Filter logs by priority level (err and above)
  • $ journalctl -p err -b
  • # Follow logs continuously in real time
  • $ journalctl -f
  • 6. The Three Init Systems LPI Expects You to Recognise

Objective 101.2 asks for knowledge of SysVinit and systemd and explicit awareness of Upstart . Upstart is the one most candidates skip, and it is the one the exam is most likely to use as a distractor, because it briefly shipped as the default on Ubuntu 6.10–14.10 and on Red Hat Enterprise Linux 6.

Upstart was Canonical's event-driven replacement for SysVinit. Instead of walking a fixed sequence of numbered rc scripts, Upstart reacted to events — "filesystem mounted", "network interface came up", "another job started" — and launched jobs whose conditions those events satisfied. That made boot parallel and made service start-up ordering implicit rather than hand-numbered.

  • Property SysVinit Upstart systemd
  • Model Sequential shell scripts Event-driven jobs Parallel dependency graph of units

Job/unit location /etc/init.d/ + /etc/rc?.d/ symlinks /etc/init/*.conf /etc/systemd/system/ , /usr/lib/systemd/system/

  • Master config /etc/inittab Per-job .conf stanzas Per-unit .unit files
  • State grouping Runlevels 0 – 6 Runlevel-compatible events Targets ( multi-user.target )
  • Control command service , telinit initctl , start , stop , status systemctl
  • Log destination /var/log/messages via syslog /var/log/upstart/*.log Binary journal via journald
  • PID 1 binary /sbin/init /sbin/init (Upstart) /sbin/init → systemd

Upstart job files live in /etc/init/ — note that this is a different directory from SysVinit's /etc/init.d/ , and telling those two paths apart is a classic single-character exam trap. A minimal Upstart job looked like this: # /etc/init/myapp.conf

  • description "Example application"
  • start on runlevel [2345]
  • stop on runlevel [016]
  • respawn
  • exec /usr/local/bin/myapp
  • The initctl command was Upstart's equivalent of systemctl : # List all known Upstart jobs and their goal/state
  • initctl list
  • # Query one job
  • initctl status myapp
  • # Start and stop jobs
  • start myapp
  • stop myapp

Exam Rule: LPI only requires awareness of Upstart — you will not be asked to author a job file. Be able to (a) name it as the event-driven init system that sat between SysVinit and systemd, (b) place its job files in /etc/init/ , and (c) recognise initctl as its control command. Every current mainstream distribution has since migrated to systemd; Upstart is effectively dead outside legacy RHEL 6 and old Ubuntu LTS installs.