Ask Your Question
0

Knowing exact time of power outage looking on system logs files

asked 2015-05-27 03:02:29 -0500

ztank1013 gravatar image

When a linux box comes UP again after a power outage, which is the best file(s) to take a look at in order know with the best accuracy at what time (hh:mm and possibly seconds!) the linux box went DOWN?

edit retag flag offensive close merge delete

3 Answers

Sort by ยป oldest newest most voted
1

answered 2015-05-27 05:47:14 -0500

mclmmc gravatar image

the last command is what you need.

[michele@benemerita ~]$ last | grep boot | head -1
reboot   system boot  3.19.7-200.fc21. Wed May 27 12:17   still running

and if you put the following command into root's crontab, you know when the system went down

0-59/5 * * * * /bin/touch /root/.system-up
edit flag offensive delete link more

Comments

@mclmmc what I really need to know is the time the system went down not when it came up. I believe the "last" command provides the date/time when the OS comes UP.

ztank1013 gravatar imageztank1013 ( 2015-05-27 07:14:41 -0500 )edit
1

answered 2015-05-27 07:57:24 -0500

Rabin gravatar image

you can use a cron job which runs every minute and then look at the cron log file and look for "holes"

* * * * * nobody /usr/bin/tree

journalctl --unit crond.service

May 17 17:41:33 localhost crond[1383]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 76% if used.)
May 17 17:41:33 localhost crond[1383]: (CRON) INFO (running with inotify support)
-- Reboot --
May 18 21:46:32 localhost crond[1327]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 87% if used.)
May 18 21:46:32 localhost crond[1327]: (CRON) INFO (running with inotify support)
-- Reboot --
May 27 09:23:45 localhost systemd[1]: Started Command Scheduler.
May 27 09:23:45 localhost systemd[1]: Starting Command Scheduler...
May 27 09:23:45 localhost crond[1342]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 23% if used.)
May 27 09:23:45 localhost crond[1342]: (CRON) INFO (running with inotify support)
May 27 10:01:01 localhost CROND[12846]: (root) CMD (run-parts /etc/cron.hourly)
May 27 10:01:01 localhost anacron[12856]: Anacron started on 2015-05-27
May 27 10:01:01 localhost anacron[12856]: Will run job `cron.daily' in 28 min.
May 27 10:01:01 localhost anacron[12856]: Jobs will be executed sequentially
May 27 10:29:01 localhost anacron[12856]: Job `cron.daily' started
May 27 11:01:01 localhost CROND[18943]: (root) CMD (run-parts /etc/cron.hourly)
May 27 12:01:01 localhost CROND[19771]: (root) CMD (run-parts /etc/cron.hourly)
May 27 13:01:01 localhost CROND[21153]: (root) CMD (run-parts /etc/cron.hourly)
May 27 14:01:01 localhost CROND[24560]: (root) CMD (run-parts /etc/cron.hourly)
May 27 15:01:01 localhost CROND[25305]: (root) CMD (run-parts /etc/cron.hourly)
edit flag offensive delete link more

Comments

@Rabin I like this but what if minutes accuracy is not enough? Plus, this should have been setup before the system went down but my power outage already happened so I need something now to investigate and it cannot be cron for past events... unfortunately :(

ztank1013 gravatar imageztank1013 ( 2015-05-27 09:06:32 -0500 )edit
1

answered 2015-05-27 13:04:42 -0500

shatadru gravatar image

You can write a script to save current time in X seconds interval and run it in background : eg

bash script.sh &

Script :

#!/bin/bash
while (true)
do
date > /var/log/tick
sleep X
done

For a better solution you can create a systemd unit which will run this on system startup, however in that case you have to make sure when the script is run, it archives the old file "/var/log/tick" You can add the following line in script before the loop:

tar cvf /var/log/tick-`date +%d%m%y_%H%M%S`.tar /var/log/tick

This will work in case of power outage, system or application initiated reboot or even a panic.

However if the system is hung this will not be much of help.

edit flag offensive delete link more

Comments

@shatadru Actually I need something to troubleshoot now that the event has already happened... any file with a time-stamps in it which is frequently written by the OS I could look at?

ztank1013 gravatar imageztank1013 ( 2015-05-30 03:33:39 -0500 )edit

You can check journal logs just before reboot:

journalctl |grep -B20 -i '\- reboot \-'

If sysstat is installed and configured to collect data in regular interval you can check sar/sa files under /var/logs/sa/

Apart from that you can check different log files (e.g. access log in case of http server)

However none of them will ensure the exact shutdown time.

In case of a sever you can check hardware logs to check the exact outage time.

shatadru gravatar imageshatadru ( 2015-06-05 19:31:05 -0500 )edit

Question Tools

1 follower

Stats

Asked: 2015-05-27 03:02:29 -0500

Seen: 1,652 times

Last updated: May 27 '15