System Crash wich logs may I see?

[Orlando Marquez_1]

Hi All.
I need to know in wich log files may I see to find any System crash, something like abnormal shutdown; I have already looked for in the syslog.log and OLDsyslog.log files but I see nothing.

Are there others log files?

B.R.
Orlando

[Mel Burslan]

/etc/shutdownlog
/var/tombstones/ts99
/var/adm/crash

are good places to look at.

if your /var/tombstones/ts99 file has the crash date, it may be useful for analysis of your crash.

[Rick Garland]

There is the /etc/shutdown.log

Will tell you if a reboot or PANIC occurred.

[saju_2]

Hi

If you are asking for the crashdump file created during a TOC (transfer of Control), then the files will be in the crashfile system you have configured. File name will be crash.x where x will be an integer. This file is not readable and it can be analysed by HP internal software.

Regards
CS

[HGN]

Hi

The files you want to look at would be

/var/tombstones/ts99
-rw-r--r-- 1 root root 98229 Jun 29 14:41 ts99
/var/adm/crash


Hope this helps

Rgds

HGN

[Orlando Marquez_1]

Hi all.
Thans for your cooperation but when I check the shutdownlog
-rwxrwxrwx 1 bin bin 2601 Jun 4 15:32 shutdownlog

You can see the last entry for this file was in Jun 4 and the crash was in Jul 08

even the last sunday the system was restarted with the command #shutdown -r 0

Do you thing someone edit this file?

B.R.
Orlando

[Orlando Marquez_1]

Ah!
And the /var/adm/crash directory is empty :(

B.R.
Orlando

[Mel Burslan · Accepted solution]

editing the file and changing the date with a touch command is awlways a possibility if someone has the root equivalent access.

Having said that, usually abrupt system outages like someone tripping over the power cord etc, does not get logged into the shutdown log. It only records when an OS requested (either from prompt or due to a kernel panic) shutdown/reboot happens.

look at the date of your /var/tombstones/ts99. is it from Jul 08 ? If yes, do a

more /var/tombstones/ts99

if on top it says
* * * No valid timestamp * * *
then you are pretty much out of luck but if there is a reasonable date, you may want to conatct HP to determine what may have caused the problem.

Also, what type of server is this one ? If it is a reasonably recent model, you may want to get to the GSP console and use Show Logs feature to see if there was any hardware failures which may have caused the crash.

[Orlando Marquez_1]

Hi.

-rw-r--r-- 1 root root 46617 Jul 10 19:26 ts99

This is the top of the file ts99:


CPU-ID( Model ) = 0x13

------- Processor 0 HPMC Information - PDC Version: 44.12 ------

Timestamp = Sat Dec 4 19:44:16 GMT 2004 (20:04:12:04:19:44:16)

HPMC Chassis Codes

Chassis Code Extension
------------ ---------
0x0000082000ff6242 0x0000000000000000
0x1800082011006322 0xcb81800000000000
0x0000082000ff6462 0x0000000000000000

and It has a valid Timestamp

The problem was caused for a electrical power shutdown and the UPSs didn´t work correctly :(

Tanks a lot again
B.R.
Orlando

[Mel Burslan]

Unfortunately, unless you have a smart UPS which can tell you loss of mains power and get it logged somewhere in the syslog, you will not be able to determine why your system died when the power goes bad. I am assuming you either have a very old system which gets fed from a single power source or your datacenter/computer room does not have redundant power sources. If you have either case and running a mission critical operation on your hp-ux server, this is a good opportunity to justify cost of redundancy. My 2 cents...

[Mahesh Kumar Malik]

Hi

Please check
/var/adm/syslog/OLDsyslog.log
/etc/shutdown.log & /var/adm/crash files

Regards
Mahesh

[Brad Baron]

Geez-O-Petes! I find a question I can answer and not 5 minutes after post you guys are all over it. Tough crowd!!

[Orlando Marquez_1]

Thanks to all.
It is incredible as with a simple cuestion I can learn so much of you

[Fabio Ettore]

Hi Orlando,

in this forum it is very nice to assign points too.
It will help people with the same problem/question that in the future will search in ITRC forum.

Please assign points....

Thanks for your collaboration!

Best regards,
Fabio

no points for me here please...