OpenVMS reboot evidence...

[smsc_1]

Dear HP Engineer,
about OpenVMS reboot evidence I Checked following files:

SYS$SYSROOT:[SYSEXE]STARTUP.LOG
SYS$ERRORLOG:CLUE*
SYS$SYSROOT:[SYSMGR]OPERATOR.LOG

My question:
Is there any other files that I can check to see when the cluster or single node was rebooted??

Thanks!

[Ian Miller.]

No HP Engineers around here - officially anyway :-)

However - you can look in the system error log.
The tool you do that depends on which VMS version and platform you are running.


I would expect there to be a new OPERATOR.LOG on a boot.

STARTUP.LOG - depends on the setting of system parameter STARTUP_P2

[Karl Rohwedder]

If you just want to know the boottime:
$ write sys$output F$getsyi("boottime")
22-JUL-2009 18:49:05.00

The cluster was formed at:
$ write sys$output F$Getsyi("Cluster_Ftime")
27-JUN-2008 08:48:34.70

regards Kalle

[smsc_1]

Thanks for reply, by the why, I need to know if the machine was rebooted on a specific date (April 13/14/15, 2009) and for sure during this last months machine was rebooted a lot of times!!! So boottime doesn't help me! :(
Also OPERATOR.LOG was purged since last week!!

STARTUP.LOG help me, but is there any other reboot evidence??

[Kris Clippeleyr]

Hi,


Also OPERATOR.LOG was purged since last week!!

STARTUP.LOG help me, but is there any other reboot evidence??


As Ian said, check the error logfile
( SYS$ERRORLOG:ERRLOG.SYS ). You might need WEBES to do so; or use ANALYZE/ERR/ELV.
Normally, (re)boot events are recorded there.

Kris (aka Qkcl)

[smsc_1]

Kris,
unfortunately ERRLOG.SYS was purged too:

Directory SYS$SYSROOT:[SYSERR]

ERRLOG.LIS;1 108/112 27-OCT-2008 09:19:15.03
ERRLOG.SYS;1 892/896 1-AUG-2009 00:05:34.59
ERRLOG_MONTH_06.SYS;1 145/160 1-JUL-2009 00:02:16.62
ERRLOG_MONTH_07.SYS;1 3328/3328 1-AUG-2009 00:03:21.12

So if need to check April I don't think I can find it on ERRLOG.SYS or previous files.

An HP Engineers advice me to use following methods:
Audit Server or ACCOUNTING
But I don't know how to use it and actually this engineer is unreachable! :(

By the way using

[Ian Miller. · Accepted solution]

You may be able to retrieve older error log from backups.


Do SHOW AUDIT/JoURNAL

to find out where your audit journals are kept.

do ANAL/AUDIT to look at them.

[Richard W Hunt]

Do not purge old ERRLOG.SYS files, OPERATOR.LOG files, and various other system files. Move time to other disks, or zip them, or something. NEVER get rid of those critical security files when you are getting "buggy."

If you have the resources to allow it, set yourself up to do at least a selective crash dump. If it is due to a bugcheck, you'll get enough to come back here with specifics.

[cdan]

$type clue$history

This could be in a different place than SYS$ERRORLOG:CLUE*, depending on local configuration.
IF your CLUE is running correctly during boot, after creating the CLUE..nodename.lis it should also write a one-line entry in this clue$history file (show logical clue$history)

[cdan]

I forgot to mention, CLUE$HISTORY is obviously not accurate in case of reboots without sysdump (like electrical outages, or problems with sysdump disk).
To avoid this for the future, you could write very small procedure and put it somewhere in startup files to write/append to a file that system has booted, even if there is no sysdump.
Much better would be if you had the serial port OPA0 (com1) connected to some remote node running a monitoring/logging software like Console Manager or Cockpit Manager.

[Jon Pinkley]

smsc,

It appears you have a monthly job that renames the current errlog.sys file. Restore what is probably called ERRLOG_MONTH_04.SYS given the naming convention you are using.

If you don't have backups, you need to get that fixed so you won't have other problems.

If you are using a recent version of 64 bit VMS, then you can use the following command to find entries related to startups.

$ pipe analyze/error/elv translate/one_line sys$errorlog:errlog.sys/include=control_entries | search/nowin sys$pipe start

For a bit more info you can use

$ pipe analyze/err/elv translate sys$errorlog:errlog.sys /include=control_entries | search/nowin sys$pipe control_entries,seconds

This will give you information on seconds since boot for each entry.

Replace sys$errorlog:errlog.sys with the error log file you want to look at.

Use the above commands with your existing errlog.sys file so you can see what the info looks like.

Jon

[Peter Weaver_1]

You asked about using ACCOUNTING, if you still have the data available you can try ACCOUNTING/TYPE=SYSINIT.

[smsc_1]

Thanks to all... I learn a lot of OpenVMS usefull commands.

Thread closed and points assigned! ;)