Last Command - No Records for Reboot

[Manoj Sooka]

Good Day

We have a number of HP-UX V10.20 and V11.00 servers on which the 'last reboot' produces no data. This despite having done reboots on these servers lately.
However on two of out V11.00 servers it does work correctly giving the server reboot details.
Are there missing patches on the other servers or does something need to be set-up for this to work correctly ?

Thanks in advance.

Manoj

[Sukant Naik]

Hi Manoj,

There will be a file called

/etc/shutdownlog which contains entries about last reboots.

You can get the information from there too.

-Sukant

[Helen French]

Hi Manoj:

Two files to check for finding out the reboot/shutdown details:

1) /etc/shutdownlog - this will give you the time, reason and the user name

2) /etc/rc.log.old - rc script logs

HTH,
Shiju

[Duncan Edmonstone]

Could be that the file /var/adm/wtmp has been 'trimmed' by someone recently - this would remove the info that last uses.

Altarenatively, the file may have become corrupted:

man fwtmp

for info on fixing

HTH

Duncan

[S.K. Chan]

Do this ..

# /usr/sbin/acct/fwtmp < /etc/wtmp | grep boot

do you get anything back. If not then by running ..

# last rebooot
or
# last -2 reboot

will not give you any information.

[Darrell Allen]

Hi Manoj,

"last" gets its information from /var/adm/wtmp. Has that file been truncated? "who -b /var/adm/wtmp" is another way to see the reboot dates and times.

Darrell

[Helen French]

Hi Manoj (again):

Does those reboot/shutdown were invoked by SAM ? I think the reboot invoked by SAM will not be listed in the wtmp file and thereby in the last reboot command. But you can find it out from the /etc/shutdownlog file. Compare these two.

Also try this:

# last | grep reboot

HTH,
Shiju

[Manoj Sooka]

Hi All

Thanks for all your responses.

1. The wtmp file is not truncated or corrupt since records of all the other logins can be extracted. Also this is happening on 10 servers. On 2 servers it is working correctly.
It seems to be related more to the reboot pseudo-user not logging entries into wtmp at each shutdown and reboot.
I have tried all your suggestions and there are no boot records in wtmp.

2. The shutdown log does not record abnormal server shutdowns but only the reboot upon startup after such failures.
That is why the wtmp seems to be more accurate for reboot information.

Any other suggestions will be most welcome

Mano

[Michael Tully]

Hi,

The /etc/shutdownlog does show entries other than for 'reboot'. Here is a sample from one of my systems.

20:22 Sat Jan 12, 2002. Reboot:
20:24 Sat Jan 19, 2002. Reboot:
20:23 Sat Jan 26, 2002. Reboot:
13:53 Thu Jan 31 2002. Reboot after panic: Data page fault
20:22 Sat Feb 2, 2002. Reboot:
20:24 Sat Feb 9, 2002. Reboot:
20:26 Sat Feb 16, 2002. Reboot:
20:23 Sat Mar 2, 2002. Reboot:
16:35 Sat Mar 9, 2002. Halt: (by jumbo!tully)
20:25 Sat Mar 16, 2002. Reboot:
20:23 Sat Mar 23, 2002. Reboot:
20:26 Sat Mar 30, 2002. Reboot:
20:24 Sat Apr 6, 2002. Reboot:
20:26 Sat Apr 13, 2002. Reboot:
19:20 Sat Apr 20, 2002. Reboot: (by jumbo!tully)
20:24 Sat Apr 20, 2002. Reboot:
20:23 Sat Apr 27, 2002. Reboot:
20:25 Sat May 4, 2002. Reboot:

Suggest you have a look at some of the patches on some of your systems. This extract was done on a HPUX 11 system with June 2001 patching.

HTH
~Michael~

[Manoj Sooka]

Thanks Michael

The shutdownlog does not seem to record entries for power failures, unless as you suggested this is because of missing patches.
But the wtmp does seem to have accurate records as the 'reboot user' logoff is recorded at failures.

Manoj