topic Re: Accurate Boot/shutdown log in Operating System - HP-UX

Accurate Boot/shutdown log

Scott McDade — Tue, 18 Nov 2003 11:44:30 GMT

Hey all-

I am trying to figure out when one of my HP-UX 11i systems was rebooted. In looking at the /etc/shutdownlog it tells me - 15:44 Thu Sep 4, 2003. Reboot:

But when I do a who -r it tells me Oct 31 15:45

Which is accurate and why would they not correlate?

Re: Accurate Boot/shutdown log

Pete Randall — Tue, 18 Nov 2003 11:46:35 GMT

What does uptime tell you? I would trust who -r or uptime more than shutdownlog - it may not get written to in the case of a panic/crash.

Pete

Re: Accurate Boot/shutdown log

Jeff Schussele — Tue, 18 Nov 2003 11:47:26 GMT

Hi Scott,

If the system panics catastrophically - i.e. a bad HW failure, it may not get the chance to write to the shutdownlog.

Do you roll the syslog.log regularly?
Check when it last restarted, that would be a big clue.

My 2 cents,
Jeff

Re: Accurate Boot/shutdown log

Pete Randall — Tue, 18 Nov 2003 11:50:14 GMT

You can also look at the timestamp on the init process:

ps -ef |grep init

Pete

Re: Accurate Boot/shutdown log

doug mielke — Tue, 18 Nov 2003 11:53:02 GMT

power fails can also cause a reboot without a shutdown. date on the /var/adm/syslog.old can also give time of reboot.

Re: Accurate Boot/shutdown log

Bill Hassell — Tue, 18 Nov 2003 13:18:07 GMT

shutdownlog (or any log for that matter) cannot have a realtime entry for powerfail or crash. There is nothing running so nothing gets written. Instead, during a crash, the crash dump will contain the timestamp of the crash and on reboot, savecrash will write the crash time into shutdownlog. Now for a powerfailure, I believe that EMS (the online diagnostics) may actually write the powerfail time into shutdownlog so if you don't have the online daigs running, that would explain the lack of a powerfail log entry. The diags get the powerfail timestamp from the CPU hardware.