LPIC-1 Module 1: System Architecture – A Complete Study Guide with Quiz & Commands

Published On: 29 June 2025

Objective

System Architecture forms the foundational knowledge required for any Linux system administrator. Whether you are aspiring to clear certification exams like LPIC-1 or RHCSA, or aiming to master real-world Linux systems, understanding how hardware and software interact is critical. This blog dives deep into the system's inner workings, covering topics from hardware configuration to system booting and managing runlevels or boot targets. We will walk you through the core aspects of system architecture, explain each sub-topic in detail and provide practice MCQs to reinforce your understanding.

Topic 101.1: Determine and Configure Hardware Settings

What is Determine and Configure Hardware Settings?

Refers to the process of identifying and managing the physical components and resources of a Linux system. This includes enabling/disabling integrated peripherals in BIOS/UEFI, understanding and working with mass storage devices (HDDs, SSDs, USBs), determining and interpreting system hardware resource allocation (like IRQs and memory addresses) and using Linux utilities like lspci, lsusb, dmidecode, and lshw to gather detailed hardware data. It also involves manipulating USB devices when needed and understanding how the Linux kernel and user space interact through systems like sysfs, udev, and dbus for dynamic hardware detection and configuration. Understanding the system's hardware setup is crucial for troubleshooting, optimizing performance and ensuring compatibility.

Enable and Disable Integrated Peripherals

Integrated peripherals (like sound cards, network adapters, and USB controllers) can usually be enabled or disabled from the BIOS/UEFI setup. This is useful for disabling unused hardware and resolving conflicts.

Differentiate Between Various Types of Mass Storage Devices

Mass storage devices fall into categories such as:

 

Type Technology Interface Speed Durability Common Use Case
HDD Magnetic Spinning SATA Slow (~100 MB/s) Moderate General storage, backup
SSD NAND Flash SATA or NVMe Fast (500 MB/s - 3 GB/s) High OS boot drive, application storage
NVMe SSD NAND Flash PCIe Very Fast (>3 GB/s) High High-performance systems
USB Drive NAND Flash USB 2.0/3.0/3.1 Variable (20 MB/s - 400 MB/s) Medium Portable file transfer

 

  • HDD: Traditional spinning disk, slower, prone to mechanical wear, cost-effective for large storage.
  • SSD: Faster due to lack of moving parts, used in desktops and laptops for performance.
  • NVMe: SSDs that leverage PCIe lanes, commonly found in high-end and gaming systems.
  • USB: Plug-and-play, widely compatible, suitable for quick data transfers and live OS installations.

Each type has trade-offs between speed, cost and endurance. Choosing the right type depends on the workload and performance expectations.

Determine Hardware Resources for Devices

Hardware resources like IRQs (Interrupt Request Lines), I/O ports and DMA channels can be listed using tools like:

lspci -v    # Show detailed PCI device info including IRQs
lsusb -v    # Verbose output of USB device descriptors

Tools and Utilities to List Hardware Information

 

Tool Description
lspci Lists PCI devices
lsusb Lists USB devices
dmidecode Shows BIOS and hardware details
lshw Detailed list of all hardware
cat /proc/cpuinfo Shows CPU info
cat /proc/meminfo Shows RAM info

 

Tools and Utilities to Manipulate USB Devices

Linux provides several tools to interact with and manage USB devices beyond just listing them. These tools are especially useful when dealing with USB modems, tethered devices, or USB storage that needs specific handling:

usb_modeswitch: This tool is primarily used for switching USB devices that present themselves initially as CD-ROMs (containing drivers or installers) into modem or mass storage modes. It is especially useful for mobile broadband dongles.

sudo usb_modeswitch -v 12d1 -p 1f01 -M '55534243123456780000000000000011062000000100000000000000000000'

udisksctl: This utility interacts with the UDisks service and can mount, unmount, or power off USB storage devices cleanly.

udisksctl mount -b /dev/sdb1       # Mount a USB partition
udisksctl unmount -b /dev/sdb1     # Unmount the USB partition
udisksctl power-off -b /dev/sdb    # Safely power off the USB device

lsusb -v: Provides verbose output about connected USB devices, including configuration descriptors.

dmesg | grep usb: Helpful for viewing kernel messages related to USB device insertion or removal.

These tools together allow administrators to not only view but also control and troubleshoot USB device behavior on Linux systems.

  • usb_modeswitch: Switch USB devices between modes (e.g., modem/storage).
  • udisksctl: Manages disks and storage devices.

Conceptual Understanding of sysfs, udev, and dbus

sysfs: Sysfs is a virtual filesystem provided by the Linux kernel that exposes information about various kernel subsystems, hardware devices and associated device drivers. It is mounted at /sys and allows administrators and software to query and modify device attributes in real-time.

udev: udev (userspace /dev) is the device manager for the Linux kernel. It dynamically creates and removes device nodes in the /dev directory when hardware is added or removed from the system. udev listens to kernel uevents (notifications about hardware changes) and applies rules to determine how to handle devices like assigning permissions, creating symlinks, or triggering specific scripts. It is essential for maintaining a consistent and flexible device naming scheme.

dbus: D-Bus (Desktop Bus) is a message bus system that allows for communication between multiple processes running concurrently on the same machine. It is widely used in modern desktop environments and system components to facilitate inter-process communication (IPC). For example, NetworkManager and systemd communicate over D-Bus to manage network interfaces or system states.

Together, these components enable the Linux system to recognize, manage and communicate with hardware dynamically and flexibly, ensuring seamless integration and control from kernel to user-space applications.

Practice MCQs

  1. Which command lists information about USB devices connected to your Linux system?

    A) lspci
    B) lsmod
    C) lsusb
    D) modprobe

    Answer: C) lsusb

  2. What does the /sys/ directory represent in Linux?

    A) Stores system log files
    B) User profile directory
    C) A virtual file system for kernel information
    D) Network configuration

    Answer: C) A virtual file system for kernel information

Topic 101.2: Boot the System

What is Boot the System?

"Boot the System" refers to the entire process a Linux machine goes through to become a running system; from the moment power is turned on until the user is presented with a login prompt or desktop environment. This includes hardware initialization, loading the kernel, mounting the root filesystem and starting essential system services. Understanding this process is essential for Linux administrators, especially when troubleshooting boot issues, configuring bootloaders, or modifying kernel parameters.

The boot process involves:

  • BIOS/UEFI initialization
  • Bootloader (like GRUB) execution
  • Kernel loading
  • Initial RAM filesystem (initramfs) use
  • Init system (like systemd) taking over

Each of these stages has its own role and set of tools and logs to understand and troubleshoot problems effectively. The process is the journey your computer takes from powering on to a fully operational system.

Common Bootloader Commands and Kernel Options

Bootloaders like GRUB (GRand Unified Bootloader) are programs that load the operating system kernel into memory and pass control to it. GRUB allows users to select from multiple operating systems and kernel versions at boot time. One of its powerful features is the ability to modify kernel parameters directly from the GRUB menu. These parameters can be used for debugging, entering specific runlevels (like single-user mode), disabling drivers, or setting boot-time options like root filesystem or logging levels.

You can edit these parameters interactively during the boot process:

  1. At the GRUB menu, highlight the desired kernel.
  2. Press e to edit the boot entry.
  3. Locate the line starting with linux and add the required options at the end.
  4. Press Ctrl + X or F10 to boot with the modified parameters.

For example, to boot into single-user mode (useful for maintenance):

linux /vmlinuz-... ro root=/dev/sda1 single

Boot Sequence: BIOS/UEFI to Login

  1. BIOS/UEFI: The Basic Input/Output System (or Unified Extensible Firmware Interface) initializes and tests hardware during the booting process and locates the bootloader from the configured storage device.
  2. Bootloader (GRUB): Once found, the bootloader loads the Linux kernel and an initramfs image (a temporary root filesystem in RAM) into memory.
  3. Kernel: After loading, the kernel begins hardware detection and initializes drivers. It also mounts the root filesystem.
  4. initramfs: The initramfs provides an initial user-space environment which helps with early boot tasks, such as detecting RAID, LVM or encrypted partitions, before switching to the actual root filesystem.
  5. init/systemd: Finally, control is handed over to the init system (like systemd), which initializes the remaining user-space processes and system services. Once this is complete, a login prompt or graphical interface is presented.

SysVinit and systemd

SysVinit: SysVinit is a traditional init system used in older Linux distributions. It uses the /etc/inittab file to define the default runlevel and the scripts that run during system startup and shutdown. These scripts are usually located in /etc/init.d/. Processes are started serially, which can slow down boot time. SysVinit lacks advanced service monitoring features and does not automatically restart failed services.

systemd: systemd is a modern init system and service manager widely adopted in major Linux distributions like RHEL, CentOS, Ubuntu, Fedora, and Debian. It introduces the concept of units like service, socket, target, mount and uses targets instead of runlevels. systemd is faster because it starts services in parallel and has built-in service dependency tracking. It supports on-demand starting of daemons, snapshot boot states, and cgroups-based resource control.

Awareness of Upstart

Upstart was an event-based init system developed by Canonical for the Ubuntu operating system. It aimed to overcome the limitations of the traditional SysVinit system by handling starting of tasks and services during boot, stopping them during shutdown, and supervising them while the system is running. Unlike SysVinit, which follows a sequential boot process, Upstart introduced event-driven startup, allowing services to start in response to events like hardware initialization or completed network setup.

Although it introduced several improvements over SysVinit, Upstart lacked standardization across distributions and was eventually replaced by systemd, which gained wider support and offered even more advanced features like parallel service startup, socket activation, and cgroups integration. Upstart was used mainly in Ubuntu from versions 6.10 to 14.10 before Ubuntu also migrated to systemd starting with version 15.04.

Check Boot Events in Logs

dmesg         # Kernel boot messages
journalctl -b # Logs since the last boot

Practice MCQs

  1. What is the role of initramfs in the Linux boot process?

    A) Bootloader configuration
    B) First user-space process
    C) Provides temporary root filesystem
    D) Enables network services

    Answer: C) Provides temporary root filesystem

  2. Which command shows kernel-related messages at boot time?

    A) syslog
    B) lsmod
    C) journalctl -k
    D) dmesg

    Answer: D) dmesg

Topic 101.3: Change Runlevels / Boot Targets and Shutdown or Reboot System

In Linux, managing the operational state of the system whether it be booting into a multi-user mode, entering a graphical interface or shutting down safely is critical for both administration and maintenance. These operational states were traditionally referred to as runlevels in SysVinit-based systems and are now more commonly managed through targets in systemd-based systems. A runlevel or target determines which services and processes should be running. System administrators often need to switch between these for troubleshooting, maintenance like single-user mode, or system upgrades. This section also covers commands for safe shutdowns and reboots, how to alert users and how to ensure that processes are properly terminated before powering off the machine. Understanding these features ensures administrators can safely change the system state without corrupting data or disrupting users unnecessarily. In Linux, runlevels (SysVinit) or targets (systemd) determine the state of the system.

Set the Default Runlevel or Boot Target

SysVinit: The default runlevel in a SysVinit system is configured using the /etc/inittab file. You can edit this file with a text editor like vi and set the initdefault line to the desired runlevel (e.g., 3 for multi-user, 5 for graphical).

vi /etc/inittab
# Look for a line like: id:5:initdefault:
# Change the number to set the desired default runlevel

systemd: In modern Linux systems that use systemd, runlevels are replaced by targets. The default boot target can be viewed or set using systemctl commands:

systemctl get-default                    # Display the current default target
systemctl set-default graphical.target  # Set graphical target as default
# Other common targets include:
# multi-user.target (like runlevel 3)
# rescue.target (like runlevel 1)

These targets are symbolic links found in /etc/systemd/system/default.target pointing to actual target units.

Change Between Runlevels / Boot Targets

SysVinit: SysVinit uses numerical runlevels to define system states:

  • Runlevel 1: Single-user mode (maintenance mode)
  • Runlevel 3: Multi-user mode with networking
  • Runlevel 5: Multi-user mode with GUI
  • Runlevel 6: Reboot

You can switch to a different runlevel using the init or telinit commands:

init 1     # Change to single-user mode
init 3     # Change to multi-user mode with networking
telinit 5  # Change to graphical mode

systemd: systemd replaces traditional runlevels with targets that provide more flexibility and dependency handling:

  • rescue.target: Similar to runlevel 1 (single-user mode)
  • multi-user.target: Like runlevel 3
  • graphical.target: Like runlevel 5

To change to a different target immediately:

systemctl isolate multi-user.target  # Change to multi-user mode
systemctl isolate graphical.target   # Switch to GUI mode

This approach ensures that systemd handles all service dependencies cleanly while transitioning between system states.

Shutdown and Reboot from Command Line

Shutting down or rebooting a Linux system properly ensures that all processes are gracefully terminated and data integrity is maintained. These actions can be performed directly from the command line and are vital for system maintenance, applying updates, or recovering from critical issues. Here are some commonly used commands and what they do:

shutdown now: Immediately powers off the system. It notifies all users and processes and ensures proper service shutdown before powering off.

sudo shutdown now

shutdown -r +5: Schedules a system reboot after 5 minutes. It also notifies all logged-in users.

sudo shutdown -r +5

reboot: A quick way to reboot the system. Equivalent to shutdown -r now.

sudo reboot

halt: Stops all processes and halts the system. It does not power off unless explicitly told to. Used rarely.

poweroff: Immediately shuts down and powers off the system.

These commands can also include custom messages or warning prompts for users. For instance, before a shutdown:

sudo shutdown -h +10 "System maintenance in progress. Please save your work."

This command shuts down the system after 10 minutes and broadcasts the message to all users.

If you want to cancel a scheduled shutdown:

sudo shutdown -c

This is useful if a shutdown was scheduled by mistake or needs to be postponed.

Alert Users Before Shutdown

Before shutting down or rebooting a multi-user Linux system, especially in a production or shared environment, it is best practice to notify all logged-in users. This gives them time to save work and safely close applications, minimizing the risk of data loss or disruption.

How to Alert Users

The wall (write all) command is used to broadcast a message to all logged-in terminals.

Example:

wall "System will reboot in 10 minutes"

This command sends the message "System will reboot in 10 minutes" to every user currently logged in. It is typically used in conjunction with scheduled shutdown commands.

Why This Matters

  • Prevents accidental data loss.
  • Gives users time to prepare for the system going offline.
  • Improves communication and professionalism in multi-user environments.

Use Case with Scheduled Shutdown

sudo shutdown -h +10 "System will shut down in 10 minutes for maintenance."

This not only schedules the shutdown but also alerts users. The wall command is often used separately if custom messages or warnings are needed in advance.

Terminate Processes Properly

Properly terminating processes in Linux is a crucial task for system administrators. It ensures that applications and services stop gracefully, minimizing the risk of data loss or system instability. Here's a breakdown of how this is done and why it matters:

Why Proper Termination Matters

  • Prevents data corruption (e.g., when databases are writing to disk).
  • Ensures system resources (RAM, CPU) are released.
  • Avoids zombie or orphan processes that can degrade system performance.
  • Helps maintain service dependencies (especially with systemd).

Common Methods to Terminate Processes

 

Command Description Example
kill Sends a signal to a process by its PID (Process ID). The default is SIGTERM (signal 15). kill 1234
kill -9 Sends SIGKILL (signal 9), forcing termination without cleanup. Last resort. kill -9 1234
killall Kills all processes by name. Useful for stopping a specific application. killall firefox
pkill Pattern-matching kill. Kills based on name or attributes. pkill -f apache
systemctl stop Gracefully stops a service managed by systemd. sudo systemctl stop nginx

 

Signal Types (Most Common)

 

Signal Number Meaning
SIGTERM 15 Graceful stop (default for kill)
SIGKILL 9 Force stop, cannot be caught or ignored
SIGHUP 1 Hang up, often used to reload config
SIGINT 2 Interrupt (like pressing Ctrl+C)

 

How to Find Process IDs (PIDs)

You need the PID of a process to kill it directly:

ps aux | grep nginx    # Show nginx-related processes
pidof apache2          # Get PID of apache2

Graceful Service Stop via systemctl

sudo systemctl stop httpd   # Stops Apache

This method is preferable as it respects service dependencies and runs pre/post stop scripts defined in the unit file.

Awareness of acpid

acpid (Advanced Configuration and Power Interface Daemon) is a background service (daemon) that handles power management events on a Linux system. These events are generated by the system's ACPI (Advanced Configuration and Power Interface) subsystem, which is responsible for controlling things like:

  • Power button presses
  • Laptop lid open/close
  • Battery status changes
  • Sleep and suspend modes
  • Thermal zone alerts (e.g., high temperature)

How acpid Works

  • It listens for ACPI events emitted by the Linux kernel.
  • When an event occurs (e.g., user presses the power button), acpid checks its configuration files (usually in /etc/acpi/) to decide what action to take.
  • It can be configured to shut down, suspend, log a message, or execute a custom script.

Why It is Important

For system administrators, understanding acpid helps:

  • Customize power-related behavior on laptops or servers.
  • Debug unwanted shutdowns or suspend issues.
  • Monitor hardware status (especially useful in headless or embedded systems).

Practice MCQs

  1. Which command is used with systemd to change the current runlevel/target?

    A) init
    B) systemctl isolate
    C) runlevel
    D) startx

    Answer: B) systemctl isolate

  2. What does the wall command do in Linux?

    A) Displays system log
    B) Alerts all users with a message
    C) Displays disk usage
    D) Monitors memory

    Answer: B) Alerts all users with a message

Quick Reference Commands

Determine and Configure Hardware Settings

lspci                           # List PCI devices
lsusb                           # List USB devices
lsmod                           # List loaded kernel modules
modprobe <module>               # Load a kernel module
cat /proc/cpuinfo               # Show processor information
cat /proc/meminfo               # Show memory information
dmidecode                       # Display hardware information from BIOS/UEFI
lshw                            # List detailed hardware configuration
usb_modeswitch [...]            # Switch USB mode for a device (modem/storage)
udisksctl mount -b /dev/sdX1    # Mount a USB partition
udisksctl unmount -b /dev/sdX1  # Unmount the USB partition
udisksctl power-off -b /dev/sdX # Safely power off the USB device
dmesg | grep usb                # Check USB-related kernel messages

Boot the System

dmesg           # Display boot-time kernel messages
journalctl -b   # Show logs from the current boot
journalctl -k   # Show kernel ring buffer logs
# Inside GRUB menu:
# Press 'e' to edit kernel options at boot (e.g., add 'single' for single-user mode)

Runlevels / Boot Targets / Shutdown

# Systemd commands
systemctl get-default           # View default target (runlevel)
systemctl set-default <target>  # Set default boot target
systemctl isolate <target>      # Switch to a different boot target
systemctl stop <service>        # Stop a service

# Shutdown and Reboot
shutdown now                    # Immediate shutdown
shutdown -r +5                  # Reboot after 5 minutes
shutdown -h +10 "Message"       # Shutdown with message after delay
shutdown -c                     # Cancel scheduled shutdown
reboot                          # Immediate reboot
poweroff                        # Shutdown and power off
halt                            # Halt the system (without power off)

# Notify users
wall "System will reboot in 10 minutes"  # Send a broadcast message

File Paths and Important Utilities

/sys/            # Sysfs for kernel-hardware interface
/proc/           # Kernel and process info virtual filesystem
/dev/            # Device files
/etc/inittab     # Init configuration for SysVinit (legacy)
/etc/init.d/     # Legacy init scripts directory
/etc/systemd/    # Systemd configuration directory
/usr/lib/systemd/ # Systemd service files

Conclusion

System architecture is a core skill for every Linux administrator, linking hardware detection, boot processes, and service management. Mastering tools like lspci, dmidecode, and systemctl builds the foundation for troubleshooting, performance tuning, and advanced topics like networking and storage. Whether you're preparing for LPIC-1, RHCSA, or a DevOps role, this knowledge is essential for real-world success. Practice more with our free quiz: System Architecture Quiz – LPIC-1.
Stay curious, stay Linux-savvy.