how & where to check if the system was shutdown properly

[Maaz]

OS: rhel 4

how & where to check if the system was shutdown properly or not ?

Regards

[Ivan Ferreira]

You can compare the output of "uptime" and "last shutdown" commands.

With the first, you get how long the system was running, and with "last shutdown" you get the last time was powered off.

[Maaz]

I remove the power cable intentionaly to shutdown machine unproperly, then boot the system and execute the following command

# uptime
4:07am up 0:01, 2 users, load average: 1.42, 0.69, 0.26

# last shutdown

wtmp begins Wed Oct 17 12:34:54 2007

# last reboot
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 04:05 (00:01)
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 04:02 (00:04)
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 03:57 (00:03)
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 03:53 (00:03)
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 03:50 (00:06)
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 00:21 (00:45)
reboot system boot 2.6.16.46-0.12-s Tue Oct 23 21:14 (03:05)
reboot system boot 2.6.16.46-0.12-s Tue Oct 23 05:07 (01:59)
reboot system boot 2.6.16.46-0.12-s Mon Oct 22 22:21 (05:05)
reboot system boot 2.6.16.46-0.12-s Mon Oct 22 21:33 (00:16)
reboot system boot 2.6.16.46-0.12-s Mon Oct 22 21:10 (00:04)
reboot system boot 2.6.16.46-0.12-s Mon Oct 22 05:12 (00:47)
reboot system boot 2.6.16.46-0.12-s Mon Oct 22 04:23 (00:39)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 11:23 (02:48)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 11:22 (02:49)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 11:20 (00:01)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 11:19 (00:01)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 10:33 (00:48)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 07:01 (03:30)
reboot system boot 2.6.16.46-0.12-s Sat Oct 20 06:51 (03:40)

wtmp begins Wed Oct 17 12:34:54 2007

could you please evaluate from the output if the system was shutdown un-properly ?

Regards

[Maaz]

say I unplug the power cord at 02:15 and then the system boots at 8:45.
then what will be the output of "uptime" and "last shutdown" so that you will be informed that machine was shutdown unproperly ?

[Ivan Ferreira]

From the uptime command, I can see it was "4:07 am", and the system was up by about a minute "0:01".

The "last shutdown" does not displays any output, so the shutdown command was not issued.

The "last reboot" shows that the last time the system was rebooted, was "Wed Oct 24 04:05 (00:01)", that is, two minutes behind the time reported by "uptime", so the system was rebooted intentionally, and took one minute in shutdown and one minute in start (pretty fast!).

[Maaz]

Thanks Ivan for help ;)

but the output of 'uptime' and 'last reboot' doesn't shows to me that the system was down unproperly ?

# last reboot .. shows me the the time machine was down(either proper or unproper it doesnt cares)

# uptime .. shows me when the machine was boot.

from the output of the above two commands I can evaluate that how long the system was remain off/down, but i cant understand that how can we know that either system was down unproperly or properly ?

say e.g
# uptime
08:22am up 0:03, 1 user, load average: 0.22, 0.42, 0.20

and
# last reboot
reboot system boot 2.6.16.46-0.12-s Wed Oct 24 04:22 (00:03)

from the output of the above commands I can say that the machine was down/offline for almost 4 hours (uptime 08:22, and last reboot 04:22), but I cant say that machine was down UN-properly ?

[Alexander Chuzhoy]

I think that you need to define what you mean by "properly".

I think (probably same as Ivan) that by unproperly you ment that someone simply pressed the power or reboot button. This would bypass writing information to various logs, thus won't be seen in the output of "last reboot".

[Ivan Ferreira]

Yep, that was the idea. You can also check the /var/log/messsages.* file and search for:

syslog: stop syslogd succeded
syslog: stop klogd succeded

This is logged when syslog stops, and syslog will be stopped if you gracefully shutdown the system.

[Stuart Browne · Accepted solution]

Your 'messages' file should have something similar to this:

Oct 16 19:10:10 elfgrove random: Saving random seed: succeeded
Oct 16 19:10:10 elfgrove kernel: Kernel logging (proc) stopped.
Oct 16 19:10:10 elfgrove kernel: Kernel log daemon terminating.
Oct 16 19:10:11 elfgrove exiting on signal 15
Oct 16 19:25:27 elfgrove syslogd 1.4.1: restart.
Oct 16 19:25:27 elfgrove syslog: syslogd startup succeeded

This is a proper shutdown of my machine at home... and it starting up again shortly after.

Or perhaps 'last -x' is your poison?

runlevel (to lvl 3) 2.4.22-1.2199.8. Tue Oct 16 18:06 - 19:09 (01:03)
reboot system boot 2.4.22-1.2199.8. Tue Oct 16 18:04 (01:11)
shutdown system down 2.4.22-1.2199.8. Tue Oct 16 17:57 - 19:15 (01:18)
runlevel (to lvl 0) 2.4.22-1.2199.8. Tue Oct 16 17:56 - 17:57 (00:00)


For the same system, the same time period.

[Maaz]

Thanks a lot Ivane Ferreira, Alexander Chuzhoy, and Stuart Browne for help

Once again millions of Thanks dear Stuart Browne, for sharing "last -x" command :)

/var/log/messages is also a good place.

Regards
Maaz