Introduction

Technical maintenance can still fail operationally if users receive no warning. Linux provides simple channels for login-time and immediate notifications.

What you should be able to do after this lesson:

Distinguish pre-login and post-login messages.
Broadcast a message to active terminal users.
Schedule a shutdown with a warning.
Choose language that is useful during an incident.

Big Idea: Choose the Message by Session State

Linux exposes messages at different moments:

before local login -> /etc/issue
before supported remote login -> /etc/issue.net
after login -> /etc/motd or a PAM-generated message
active terminal session -> wall
scheduled shutdown -> shutdown notice

Selecting the wrong channel can produce a correct message that the affected users never see.

Login Messages

/etc/issue is commonly displayed before a local console login.
/etc/issue.net may be used before remote logins when the service is configured for it.
/etc/motd is displayed after successful login by many PAM-based systems.

Do not expose sensitive software versions or internal architecture in public pre-login banners. Legal or acceptable-use banners should be reviewed by the responsible organization.

Notify Active Users

wall "Database maintenance begins in 15 minutes. Save your work."

wall writes to terminals that permit messages. Check active sessions with w or who.

Schedule Shutdown or Reboot

sudo shutdown -r +15 "Kernel maintenance: reboot in 15 minutes"
sudo shutdown -c

On systemd systems, equivalent operations can be initiated with systemctl reboot or systemctl poweroff, but shutdown conveniently schedules and announces the event.

Write an Effective Notice

Include:

what is changing
when it starts
expected impact and duration
what users must do
where to get status updates

Avoid vague warnings such as "server going down soon" when an exact time is available.

Guided Practice: Prepare a Maintenance Notice

On a lab machine, inspect the current login-message sources:

ls -l /etc/issue /etc/issue.net /etc/motd
who
w

Draft a notice with an absolute time and timezone:

Filesystem maintenance starts 2026-09-12 at 22:00 UTC.
Interactive sessions will disconnect for approximately 15 minutes.
Save work before 21:55 UTC. Status: https://status.example.test/

Use wall only when lab users expect the broadcast. Schedule a test shutdown far enough ahead to observe its warning, then cancel it with shutdown -c. Confirm that cancellation is communicated as clearly as the original event.

Troubleshooting Scenario

An administrator updates /etc/motd five minutes before an emergency reboot, but existing SSH users never see it.

motd is generally displayed during login, not pushed to active sessions. Send an immediate wall message and use a scheduled shutdown notice. Keep motd for users who log in while the incident remains active.

Exam Focus

Distinguish /etc/issue, /etc/issue.net, and /etc/motd timing.
Use wall for active terminal users.
Use shutdown for scheduled, announced power or reboot operations.
systemctl reboot and poweroff perform actions but do not replace a communication plan.

Recap

/etc/issue is pre-login; /etc/motd is generally post-login.
wall reaches currently logged-in terminal users.
shutdown can schedule and broadcast maintenance.
Clear timing and impact matter as much as the delivery command.

206.3 Notify users on system-related issues