Accurate Boot/shutdown log

[Scott McDade]

Hey all-

I am trying to figure out when one of my HP-UX 11i systems was rebooted. In looking at the /etc/shutdownlog it tells me - 15:44 Thu Sep 4, 2003. Reboot:

But when I do a who -r it tells me Oct 31 15:45

Which is accurate and why would they not correlate?

[Pete Randall · Accepted solution]

What does uptime tell you? I would trust who -r or uptime more than shutdownlog - it may not get written to in the case of a panic/crash.


Pete

[Jeff Schussele]

Hi Scott,

If the system panics catastrophically - i.e. a bad HW failure, it may not get the chance to write to the shutdownlog.

Do you roll the syslog.log regularly?
Check when it last restarted, that would be a big clue.

My 2 cents,
Jeff

[Pete Randall]

You can also look at the timestamp on the init process:

ps -ef |grep init



Pete

[doug mielke]

power fails can also cause a reboot without a shutdown. date on the /var/adm/syslog.old can also give time of reboot.

[Bill Hassell]

shutdownlog (or any log for that matter) cannot have a realtime entry for powerfail or crash. There is nothing running so nothing gets written. Instead, during a crash, the crash dump will contain the timestamp of the crash and on reboot, savecrash will write the crash time into shutdownlog. Now for a powerfailure, I believe that EMS (the online diagnostics) may actually write the powerfail time into shutdownlog so if you don't have the online daigs running, that would explain the lack of a powerfail log entry. The diags get the powerfail timestamp from the CPU hardware.