What is the difference between shutdown 18:00 and at 18:00 shutdown?

at 18:00 shutdown now creates an "at" job, which is performed at the specified time by the at daemon or perhaps the cron daemon, depending on your system.

shutdown 18:00 starts a process in your shell that waits until the specified time and then performs the shutdown. This command can be terminated if e.g. your shell session is terminated.

The net result in most cases will be the same: the system is shutdown at 18:00.

One difference is that if you use at, the job will be stored and if the system is shutdown by some other means before 18:00, upon booting again the job will still be waiting to be run; if the time is already passed, the shutdown will be performed immediately which could be quite unexpected.

Another difference is that shutdown 18:00 will create a /run/nologin file 5 minutes before the scheduled time to prevent people logging in after that moment. Also broadcast messages will be sent to warn logged in users that the system is about to be shutdown.

You need to take account these differences to decide which to use.

And now, the systemd answer.

If you have CentOS 7, you have a systemd operating system and the answer is different.

at 18:00 shutdown now still schedules via the at subsystem, but that shutdown command, as well as the one that you invoke directly with shutdown 18:00, is different. It's actually systemd's systemctl program. systemctl does things differently.

First of all, systemctl sends the scheduled shutdown request off to be processed by a dæmon, pretty much like in the at case. This is a systemd dæmon, though, specifically logind (the systemd-shutdownd dæmon having been removed from systemd in May 2015, which change has since percolated through to later minor versions of CentOS 7), not the at subsystem. systemctl speaks an internal protocol to a (system-wide) Desktop Bus broker which in turn communicates with logind.

So, like in the at case, there's no shutdown process sitting there counting down and spawning the wall messages. So one can log out and this will not affect the schedule, and cancelling is not as simple as merely interrupting/killing the foreground process of the login session. Just like with at.

There are still messages, unlike in the at case, but they are issued by logind. Also unlike the at case, the scheduled job does not persist across system restarts, so an actual shutdown cancels a scheduled one. There is a file in the filesystem, but it is under /run/systemd/shutdown which is non-persistent storage.

Further differences are that there can be only one scheduled shutdown at a time, whereas one can submit multiple at jobs, and Policy Kit will apply rules to shutdown run in non-login-session context as an at job that are different to the rules applied to shutdown run in login-session context. The latter might be more permissive, allowing (say) an unprivileged user who is logged in to the active login session to shut down the system.

Further reading

• My answer to What is the difference between these commands for bringing down a Linux server?
• Error when running `shutdown -h now`