Mac OS version Windows

Bring the system down in a orderly way, now or at another time.

Linux version:

/sbin/shutdown [-t sec] [-arkhncfFHP] time [message]

  1. syslog message is NOT sent! (see /usr/local/bin | ~/bin)
  2. Terminal users are sent message and logins are disabled.
  3. processes are notified by the signal SIGTERM. This gives programs like editors the time to save the file being edited, other programs a chance to exit cleanly
  4. report SIGKILL to all processes
  5. change the runlevel.
    Runlevel 0 halt the system,
    Runlevel 1 the default, put to system into a state where administrative tasks can be performed;if neither -h or -r is given to shutdown /etc/inittab defines the action is taken for halt or reboot.

time can be of the form: [h]h:mm, +minutes or now

message sent to all users.

-c Cancel a running shutdown now
-a Use /etc/shutdown.allow to restrict who can shutdown
-t sec Tell init to wait sec seconds after sending processes the SIGTERM until
the kill signal and changing to another runlevel.
-k Don't shutdown; only send the message to everybody.
-r Reboot after shutdown.
-h Halt or poweroff after shutdown.
-H halt or drop into boot monitor on systems that support it.
-P power.
-f fsck is skipped on boot,
-F Force fsck on oot.
-n [DEPRECATED] Don't call init(8) to do the shutdown but do it ourself.
kill all processes, turn off quota, accounting, swapping and unmount all filesystems.
time When to shutdown.

/etc/nologin is created if shutdown is called with a delay. This causes programs such as login to deny logins. Shutdown removes this file if it is stopped before it signals init (i.e. it is cancelled or something goes wrong). Shutdown removes /etc/nologin before calling init to change the runlevel.


Shutdown can be called from init when the magic keys CTRL-ALT-DEL are pressed, by creating an appropriate entry in /etc/inittab.
This means that everyone who has physical access to the console keyboard can shut the system down.
Shutdown can check to see if an authorized user is logged in on one of the virtual consoles. If shutdown is called with -a (add this to the invocation of shutdown in /etc/inittab), it checks to see if the file /etc/shutdown.allow is present. It then compares the login names in that file with the list of people that are logged in on a virtual console (from /var/run/utmp). Only if one of those authorized users or root is logged in, it will proceed. Otherwise it will write the message to the (physical) system console.
shutdown: no authorized users logged in
/etc/shutdown.allow has one user name per line. Empty lines and comment lines (prefixed by a #) are allowed. There is a limit of 32 users in this file.

If /etc/shutdown.allow is not present, the -a is ignored.


The -H sets the init environment variable INIT_HALT to HALT, and the -P sets that variable to POWEROFF.
The shutdown script that calls halt as the last thing in the shutdown sequence should check these environment variables and call halt with the right options for these options to actually have any effect. Debian 3.1 (sarge) supports this.


/fastboot, /etc/inittab, /etc/init.d/halt, /etc/init.d/reboot, /etc/shutdown.allow

The time argument is mandatory

Pressing [CTRL]-[ALT]-[DEL] will start shutdown from a console in text mode.
If the console is running a window System, the windows server processes key strokes and processing of [CTRL]-[ALT]-[DEL] is server dependent.

/etc/shutdown.allow does not chwck who invoked shutdown, ONLY who is logged in on (one of) the console(s).


fsck, init, halt, poweroff, reboot


shutdown [-] [-h | -r | -k] [-o [-n]] time [message]

-h halt
-r reboot
-k Kick off non-super users, leaves the system multi-user with logins disabled (for all but super-user).
-o If -h or -r is specified, launchd executes halt or reboot

-n If -o is specified, prevent the file system cache from being flushed by passing -n option to halt or reboot. This option should not be used.

time when shutdown will commence.
     now indicates an immediate shutdown or
    +minutes or
The hours and minutes may be separated by a :

message broadcast to users using wall

*** System shutdown message from username@host.domainName ***
System going down at 21:06

- message is read from the standard input.

Starting at no more than 10 hours before shutdown, at intervals becoming more frequent
messages are sent to logged in users .

5 minutes before shutdown, or immediately if shutdown is in less than 5 minutes, message is copied to /var/run/nologin. When a user attempts to login, its contents are displayed and login exits. The file is removed just before shutdown exits.

At time a message is written to the system log, which includes the user who initiated the shutdown and the reason.
A signal is then sent to launchd to halt, reboot or bring the system down to single-user state.

A scheduled shutdown can be canceled by reporting SIGTERM.

echo "";     #show shutdown process information
echo kill -TERM `/bin/ps -A -o pid -o command| grep shutdown | grep -v grep` ;
echo "";     # Ask if this is the right process
echo -n " [return] to cancel shutdown, else ^C "; read resp;
export shutdownPS=`/bin/ps -A -o pid -o command| grep shutdown | grep -v grep `;
sudo kill -TERM `echo $shutdownPS | sed "s/^ \{1,3\}/0/" |cut -f1-1 -d " "`;

FILES /var/run/nologin tells login not to let anyone login, is removed automatically.

/var/log/ contains aproximately 50,000 lines of details regarding how shutdown progressed.

SEE ALSO kill(1), login(1), wall(1), nologin(5), halt(8), init(8), reboot(8)


shutdown [/i ]
/l | /s | /r | /g | /a | /p | /h ]
/e] [/d [p|u:]MM:mm [/c "comment"]]
          [/f] [/m \\computer][/t sss]
/i Display the graphical user interface( must be the first option.)
/l Log off. cannot be used with /m (other system) or /d (reason)
/s Shutdown
/r restart
/g restart; then restart any registered applications. used during the time-out period.
/m \\computer Specify the target computer.
/t sss time, in seconds, before shutdown (default 30) Force (/f) implied it not 0.
/f Force running applications to close without forewarning users implied if /t is not 0
/p with /d (reason) and /f (force) NOW!
/h Hibernate with /f
/e explain
/c "comment" the reason for the restart or shutdown.
/d [p|u:]MM:mm reason p planned u user definedi. default is unplanned. MM major reason < 255 ; mm minor reason < 655
/a Abort a system shutdown.
/? Display help.
Type Major Minor Title 
EU   0    0    Other 
E P  
 U   0    5    Other Failure: System Unresponsive
E P  1    1    Hardware: Maintenance (Unplanned)
E P  1    2    Hardware: Installation 
E P  2    2    Operating System: Recovery 
  P  2    3    Operating System: Upgrade
E P  2    4    Operating System: Reconfiguration 
  P  2   16    Operating System: Service pack 
  P  2   17    Operating System: Hot fix 
  P  2   18    Operating System: Security fix 
E P  4    1    Application: Maintenance 
E P  4    2    Application: Installation
E    4    5    Application: Unresponsive
E    4    6    Application: Unstable
 U   5   15   System Failure: Stop error
EUP  5   19   Security issue
E    5   20   Loss of network connectivity (Unplanned)
 U   6   11   Power Failure: power loss
 U   6   12   Power Failure: Environment
  P  7    0   Legacy API shutdown 

halt, reboot, poweroff

stop the system.

/sbin/halt [-n] [-w] [-d] [-f] [-i] [-p] [-h]
/sbin/reboot [-n] [-w] [-d] [-f] [-i]
/sbin/poweroff [-n] [-w] [-d] [-f] [-i] [-h]

halt notes that the system is being brought down in the file /var/log/wtmp, and then tells the kernel to halt, reboot or power-off the system.

       -d     Don't write the wtmp record.   (see last
       -w     write  the  wtmp  record  (in  /var/log/wtmp ).  Don't reboot or halt 
       -n     Don't  sync before reboot or halt. Note that the kernel and storage drivers may still sync.  implies -d.  
       -f     Force halt or reboot, don't call shutdown(8).  
       -i     interfaces for networks are shutdown just before halt or reboot.  
       -h     hard  drives  put in stand-by mode just before halt or power-off,
      causing the write cache on the disk  to be  flushed.  
       -p     poweroff When halting the system 
halt and reboot invoke shutdown(8) if the system is not in runlevel 0 or 6.

shutdown - bring the system down /sbin/shutdown [-akrhPHfFnc] [-t sec] time [warning message]

shutdown brings the system down in a secure way. users are notified that the system is going down, and login(1) is blocked.u
It is possible to shut the system down immediately or after a specified delay.
All processes are first notified that the system is going down by the signal SIGTERM. This gives programs like vi(1) the time to save the file being edited, mail and news processing programs a chance to exit cleanly, etc.
shutdown signals the init process, to change the runlevel. Runlevel 0 is used to halt the system, runlevel 6 is used to reboot the system, and runlevel 1 is used to put to system into a state where administrative tasks can be performed; this is the default if neither the -h or -r flag is given to shutdown. Actions are taken on halt or reboot are in the file /etc/inittab.

time can have format:

with a delay, creates the advisory file /etc/nologin which causes programs such as login(1) to not allow new user logins.
This file is created five minutes before the shutdown sequence starts.
Shutdown removes this file if it is stopped before it can signal init (i.e. it is cancelled or something goes wrong). and before calling init to change the runlevel.


130 time could not be parsed


An entry is writen to /var/run/utmpx which can be dispolayed using lasr