Mac OS versionWindows
Bring the system down in a orderly way, now or at another time.

Linux version:

/sbin/shutdown [-t sec] [-arkhncfFHP] time [message]

  1. Terminal users are sent message and logins are disabled.
  2. processes are notified by the signal SIGTERM. This gives programs like editors the time to save the file being edited, other programs a chance to exit cleanly
  3. report SIGKILL to all processes
  4. change the runlevel.
    Runlevel 0 halt the system,
    Runlevel 1 the default, put to system into a state where administrative tasks can be performed;if neither -h or -r is given to shutdown /etc/inittab defines the action is taken for halt or reboot.

The time argument can be of the form: hh:mm, +minutes , now

message sent to all users.
-c Cancel a running shutdown now
-a Use /etc/shutdown.allow.
-t sec Tell init to wait sec seconds after sending processes the SIGTERM until
the kill signal and changing to another runlevel.
-k Don't shutdown; only send the message to everybody.
-r Reboot after shutdown.
-h Halt or poweroff after shutdown.
-H halt or drop into boot monitor on systems that support it.
-P power.
-f fsck is skipped on boot,
-F Force fsck on oot.
-n [DEPRECATED] Don't call init(8) to do the shutdown but do it ourself.
kill all processes, turn off quota, accounting, swapping and unmount all filesystems.
time When to shutdown.

/etc/nologin is created if shutdown is called with a delay. This causes programs such as login to deny logins. Shutdown removes this file if it is stopped before it signals init (i.e. it is cancelled or something goes wrong). Shutdown removes /etc/nologin before calling init to change the runlevel.


Shutdown can be called from init when the magic keys CTRL-ALT-DEL are pressed, by creating an appropriate entry in /etc/inittab. This means that everyone who has physical access to the console keyboard can shut the system down. Shutdown can check to see if an authorized user is logged in on one of the virtual consoles. If shutdown is called with -a (add this to the invocation of shutdown in /etc/inittab), it checks to see if the file /etc/shutdown.allow is present. It then compares the login names in that file with the list of people that are logged in on a virtual console (from /var/run/utmp). Only if one of those authorized users or root is logged in, it will proceed. Otherwise it will write the message to the (physical) system console.
shutdown: no authorized users logged in
The format of /etc/shutdown.allow is one user name per line. Empty lines and comment lines (prefixed by a #) are allowed. There is a limit of 32 users in this file.

Note that if /etc/shutdown.allow is not present, the -a is ignored.


The -H option just sets the init environment variable INIT_HALT to HALT, and the -P just sets that variable to POWEROFF. The shutdown script that calls halt as the last thing in the shutdown sequence should check these environment variables and call halt with the right options for these options to actually have any effect. Debian 3.1 (sarge) supports this.


/fastboot /etc/inittab /etc/init.d/halt /etc/init.d/reboot /etc/shutdown.allow

The time argument is mandatory

Pressing [CTRL]-[ALT]-[DEL] will start shutdown from a console in text mode.
If the console is running a window System, the windows server processes key strokes and processing of [CTRL]-[ALT]-[DEL] is server dependent.

Shutdown wasn't designed to be run setuid.
/etc/shutdown.allow does not chwck who invoked shutdown, ONLY who is logged in on (one of) the console(s).


fsck, init, halt, poweroff, reboot


shutdown [-] [-h | -r | -k] [-o [-n]] time [message]

-h halt
-r reboot
-k Kick off non-super users, leaves the system multi-user with logins disabled (for all but super-user).
-o If -h or -r is specified, launchd executes halt or reboot

-n If -o is specified, prevent the file system cache from being flushed by passing -n option to halt or reboot. This option should not be used.

time when shutdown will commence.
     now indicates an immediate shutdown or
    +minutes or
The hours and minutes may be separated by a :

message broadcast to users using wall

*** System shutdown message from username@host.domainName ***
System going down at 21:06

- message is read from the standard input.

Starting at no more than 10 hours before shutdown, at intervals becoming more frequent
messages are sent to logged in users .

5 minutes before shutdown, or immediately if shutdown is in less than 5 minutes, message is copied to /var/run/nologin. When a user attempts to login, its contents are displayed and login exits. The file is removed just before shutdown exits.

At time a message is written to the system log, which includes the user who initiated the shutdown and the reason.
A signal is then sent to launchd to halt, reboot or bring the system down to single-user state.

A scheduled shutdown can be canceled by reporting SIGTERM.

echo "";     #show shutdown process information
echo kill -TERM `/bin/ps -A -o pid -o command| grep shutdown | grep -v grep` ;
echo "";     # Ask if this is the right process
echo -n " [return] to cancel shutdown, else ^C "; read resp;
export shutdownPS=`/bin/ps -A -o pid -o command| grep shutdown | grep -v grep `;
sudo kill -TERM `echo $shutdownPS | sed "s/^ \{1,3\}/0/" |cut -f1-1 -d " "`;

FILES /var/run/nologin tells login not to let anyone login, is removed automatically.

/var/log/ contains aproximately 50,000 lines of details regarding how shutdown progressed.

SEE ALSO kill(1), login(1), wall(1), nologin(5), halt(8), init(8), reboot(8)


shutdown [/i ]
/l | /s | /r | /g | /a | /p | /h ]
/e] [/d [p|u:]MM:mm [/c "comment"]]
          [/f] [/m \\computer][/t sss]
/i Display the graphical user interface( must be the first option.)
/l Log off. cannot be used with /m (other system) or /d (reason)
/s Shutdown
/r restart
/g restart; then restart any registered applications. used during the time-out period.
/m \\computer Specify the target computer.
/t sss time, in seconds, before shutdown (default 30) Force (/f) implied it not 0.
/f Force running applications to close without forewarning users implied if /t is not 0
/p with /d (reason) and /f (force) NOW!
/h Hibernate with /f
/e explain
/c "comment" the reason for the restart or shutdown.
/d [p|u:]MM:mm reason p planned u user definedi. default is unplanned. MM major reason < 255 ; mm minor reason < 655
/a Abort a system shutdown.
/? Display help.
Type Major Minor Title 
EU   0    0    Other 
E P  
 U   0    5    Other Failure: System Unresponsive
E P  1    1    Hardware: Maintenance (Unplanned)
E P  1    2    Hardware: Installation 
E P  2    2    Operating System: Recovery 
  P  2    3    Operating System: Upgrade
E P  2    4    Operating System: Reconfiguration 
  P  2   16    Operating System: Service pack 
  P  2   17    Operating System: Hot fix 
  P  2   18    Operating System: Security fix 
E P  4    1    Application: Maintenance 
E P  4    2    Application: Installation
E    4    5    Application: Unresponsive
E    4    6    Application: Unstable
 U   5   15   System Failure: Stop error
EUP  5   19   Security issue
E    5   20   Loss of network connectivity (Unplanned)
 U   6   11   Power Failure: power loss
 U   6   12   Power Failure: Environment
  P  7    0   Legacy API shutdown 

halt, reboot, poweroff

stop the system.

/sbin/halt [-n] [-w] [-d] [-f] [-i] [-p] [-h]
/sbin/reboot [-n] [-w] [-d] [-f] [-i]
/sbin/poweroff [-n] [-w] [-d] [-f] [-i] [-h]
halt notes that the system is being brought down in the file /var/log/wtmp, and then either tells the kernel to halt, reboot or power-off the system. If halt or reboot is called when the system is in normal multi user mode (not in runlevel 0 or 6), shutdown will be invoked instead (with -h or -r ). The rest of this manpage describes the behaviour in runlevels 0 and 6, that is when the systems shutdown scripts are being run. -d Don't write the wtmp record. -w write the wtmp record (in the /var/log/wtmp file). Don't reboot or halt -n Don't sync before reboot or halt. Note that the kernel and storage drivers may still sync. implies -d. -f Force halt or reboot, don't call shutdown(8). -i interfaces for networks are shutdown just before halt or reboot. -h hard drives put in stand-by mode just before halt or power-off. -p poweroff When halting the system halt and reboot invoke shutdown(8) if the system is not in runlevel 0 or 6. This means that if halt or reboot cannot find out the current runlevel (for example, when /var/run/utmp hasn't been initialized correctly) shutdown will be called, which might not be what you want. Use the -f flag if you want to do a hard halt or reboot. The -h flag puts all hard disks in standby mode just before halt or power-off. causing the write cache on the disk to be flushed. This is important for IDE drives, since the kernel doesn't flush the write cache itself before power-off. The halt program uses /proc/ide/hd* to find all IDE disk devices, which means that /proc needs to be mounted when halt or poweroff is called or the -h switch will do nothing. shutdown - bring the system down /sbin/shutdown [-akrhPHfFnc] [-t sec] time [warning message] shutdown brings the system down in a secure way. All logged-in users are notified that the system is going down, and login(1) is blocked. It is possible to shut the system down immediately or after a specified delay. All processes are first notified that the system is going down by the signal SIGTERM. This gives programs like vi(1) the time to save the file being edited, mail and news processing pro- grams a chance to exit cleanly, etc. shutdown does its job by signalling the init process, asking it to change the runlevel. Runlevel 0 is used to halt the system, runlevel 6 is used to reboot the system, and runlevel 1 is used to put to system into a state where administrative tasks can be performed; this is the default if neither the -h or -r flag is given to shutdown. To see which actions are taken on halt or reboot see the appropriate entries for these runlevels in the file /etc/inittab. The time argument can have different formats. If shutdown is called with a delay, it will create the advisory file /etc/nologin which causes programs such as login(1) to not allow new user logins. This file is created five minutes before the shutdown sequence starts. Shutdown removes this file if it is stopped before it can signal init (i.e. it is cancelled or something goes wrong). It also removes it before calling init to change the runlevel.