topic Re: System Crash wich logs may I see? in Operating System - HP-UX

System Crash wich logs may I see?

Orlando Marquez_1 — Tue, 12 Jul 2005 11:15:28 GMT

Hi All.
I need to know in wich log files may I see to find any System crash, something like abnormal shutdown; I have already looked for in the syslog.log and OLDsyslog.log files but I see nothing.

Are there others log files?

B.R.
Orlando

Re: System Crash wich logs may I see?

Mel Burslan — Tue, 12 Jul 2005 11:17:53 GMT

/etc/shutdownlog
/var/tombstones/ts99
/var/adm/crash

are good places to look at.

if your /var/tombstones/ts99 file has the crash date, it may be useful for analysis of your crash.

Re: System Crash wich logs may I see?

Rick Garland — Tue, 12 Jul 2005 11:18:19 GMT

There is the /etc/shutdown.log

Will tell you if a reboot or PANIC occurred.

Re: System Crash wich logs may I see?

saju_2 — Tue, 12 Jul 2005 11:22:15 GMT

Hi

If you are asking for the crashdump file created during a TOC (transfer of Control), then the files will be in the crashfile system you have configured. File name will be crash.x where x will be an integer. This file is not readable and it can be analysed by HP internal software.

Regards
CS

Re: System Crash wich logs may I see?

HGN — Tue, 12 Jul 2005 11:43:58 GMT

Hi

The files you want to look at would be

/var/tombstones/ts99
-rw-r--r-- 1 root root 98229 Jun 29 14:41 ts99
/var/adm/crash

Hope this helps

Rgds

HGN

Re: System Crash wich logs may I see?

Orlando Marquez_1 — Tue, 12 Jul 2005 14:15:37 GMT

Hi all.
Thans for your cooperation but when I check the shutdownlog
-rwxrwxrwx 1 bin bin 2601 Jun 4 15:32 shutdownlog

You can see the last entry for this file was in Jun 4 and the crash was in Jul 08

even the last sunday the system was restarted with the command #shutdown -r 0

Do you thing someone edit this file?

B.R.
Orlando

Re: System Crash wich logs may I see?

Orlando Marquez_1 — Tue, 12 Jul 2005 14:19:11 GMT

Ah!
And the /var/adm/crash directory is empty :(

B.R.
Orlando

Re: System Crash wich logs may I see?

Mel Burslan — Tue, 12 Jul 2005 14:22:47 GMT

editing the file and changing the date with a touch command is awlways a possibility if someone has the root equivalent access.

Having said that, usually abrupt system outages like someone tripping over the power cord etc, does not get logged into the shutdown log. It only records when an OS requested (either from prompt or due to a kernel panic) shutdown/reboot happens.

look at the date of your /var/tombstones/ts99. is it from Jul 08 ? If yes, do a

more /var/tombstones/ts99

if on top it says
* * * No valid timestamp * * *
then you are pretty much out of luck but if there is a reasonable date, you may want to conatct HP to determine what may have caused the problem.

Also, what type of server is this one ? If it is a reasonably recent model, you may want to get to the GSP console and use Show Logs feature to see if there was any hardware failures which may have caused the crash.

Re: System Crash wich logs may I see?

Orlando Marquez_1 — Tue, 12 Jul 2005 14:49:15 GMT

Hi.

-rw-r--r-- 1 root root 46617 Jul 10 19:26 ts99

This is the top of the file ts99:

CPU-ID( Model ) = 0x13

------- Processor 0 HPMC Information - PDC Version: 44.12 ------

Timestamp = Sat Dec 4 19:44:16 GMT 2004 (20:04:12:04:19:44:16)

HPMC Chassis Codes

Chassis Code Extension
------------ ---------
0x0000082000ff6242 0x0000000000000000
0x1800082011006322 0xcb81800000000000
0x0000082000ff6462 0x0000000000000000

and It has a valid Timestamp

The problem was caused for a electrical power shutdown and the UPSs didnÂ´t work correctly :(

Tanks a lot again
B.R.
Orlando

Re: System Crash wich logs may I see?

Mel Burslan — Tue, 12 Jul 2005 19:35:48 GMT

Unfortunately, unless you have a smart UPS which can tell you loss of mains power and get it logged somewhere in the syslog, you will not be able to determine why your system died when the power goes bad. I am assuming you either have a very old system which gets fed from a single power source or your datacenter/computer room does not have redundant power sources. If you have either case and running a mission critical operation on your hp-ux server, this is a good opportunity to justify cost of redundancy. My 2 cents...

Re: System Crash wich logs may I see?

Mahesh Kumar Malik — Tue, 12 Jul 2005 23:55:20 GMT

Hi

Please check
/var/adm/syslog/OLDsyslog.log
/etc/shutdown.log & /var/adm/crash files

Regards
Mahesh

Re: System Crash wich logs may I see?

Brad Baron — Wed, 13 Jul 2005 01:30:55 GMT

Geez-O-Petes! I find a question I can answer and not 5 minutes after post you guys are all over it. Tough crowd!!

Re: System Crash wich logs may I see?

Orlando Marquez_1 — Wed, 13 Jul 2005 07:50:26 GMT

Thanks to all.
It is incredible as with a simple cuestion I can learn so much of you

Re: System Crash wich logs may I see?

Fabio Ettore — Wed, 13 Jul 2005 08:05:17 GMT

Hi Orlando,

in this forum it is very nice to assign points too.
It will help people with the same problem/question that in the future will search in ITRC forum.

Please assign points....

Thanks for your collaboration!

Best regards,
Fabio

no points for me here please...