incorrect reboot-logs?
 

Hi altogether;

I´ve recently taken a look at my reboot-logs with last -x | grep reboot .
Here it occurred to me that the first entry is correct. Well, my system is running right now, so that´s o.k.

Yet the following two entries make no sense at all. Yesterday (Sun Aug 26) and the day before (Sat Aug 25) it shut down my computer as I always do.
A normal clean shutdown. Despite that fact there´s the entry "still running".
But not so with all the other preceding entries.

And last -x | grep shutdown shows me the following:
It´s odd that yesterday´s shutdown (Sun Aug 26) doesn´t show up at all. And again: I performed a normal shutdown.

Does anybody know what´s going on here?

Tnx a lot in advance.

Greetings
Rosika :confused:

P.S.:
my system: Lubuntu 16.04.5 LTS, 64 bit

Taking a single line like that isn't very informative.

I would point you at August 25; the 'shutdown' & 'reboot' entries occur at 13:22 - like they're part of the same process.You check the logs before Aug 25 to see if it's a pattern.

Hi business_kid,

tnx for your answer.
Well, as you can see the logs before Aug 25 seem to be o.k.

I also checked today:One entry more that says "still running" (yesterday´s entry). That´s the only pattern I can see.
What strikes me as odd is the fact that this phenomenon can be seen since the point in time when I updated the system from kernel 4.4.0-133 to 4.4.0-134 .....

Also:no new entry since the new kernel :Pengy:

last -x | grep -E '(reboot)|(shutdown)'
probably would be better

Hi pan64,

Well, I did what you suggested:I still think it´s odd that only after the installation of the new kernel the persistent "still running"-message occurs.

Plus: Why aren´t there any more "shutdown entries" lately?

See here: https://unix.stackexchange.com/quest...-still-running

From the reply (my highlighting):

Let us know if that is what you experience.

I found the thread in question by searching for "last -x" multiple "still running" - there are quite a few hits.

Hi hydrurga,

tnx for your suggestion and the link.

That might be a nice enough explanation but it doesn´t apply here.
I always perform an orderly shutdown, there wasn´t a power loss or anything like that.

I even performed a shutdown via terminal with
(just in case ....)

But the results remain the same. Next time I look at the logs there´s one entry more with "still running" together with "reboot". And never a "shutdown" entry any more.

I´m at my wit´s end.

Why are you at your wits end for something that doesn't affect the operation of your computer? If you search for that string I mentioned before, you will see that others have commented that the last command does this sometimes.

Experiment. Try shutting down using different methods e.g. GUI shutdown/reboot rather than command line if you're running X. See how the different methods affect the output from that command.

It could well be that shutdown -h now is too quick for the computer - there could be processes running in the background that don't have time to shut down cleanly. Try the softest, highest-level shutdown that you can. Then try the softest, highest-level reboot that you can find. Then try shutting down all key background processes before a shutdown to see if you can determine a process that is not behaving correctly and not shutting down cleanly.

Hi hydrurga,

Well, normally I use the GUI shutdown-method. It was just now that I tried the command line in order to find out whether this changes anything.
So I tried out two methods of shutting down/rebooting.

I also looked at the entries with zcat /var/log/syslog.[2-7].gz | grep -i shutdown and zcat /var/log/syslog.[2-7].gz | grep -i reboot in order to see if there´s anything unusual to see (especially with reference to the "Aug 25"-border when the last "shutdown"-entry can be seen:
Yet I can´t find anything unusual.

This seems a good idea but I´m not quite sure how to go about doing that. :o

Here's another page, found through wtmp database user reboot that indicates that this can occur if the system changes the time during a session:

https://unix.stackexchange.com/quest...ppeared-twice#

If you look at the original output that you provided, you will see that there a number of occurrences where several reboot logins end at the same time e.g. Wed Aug 15 19:06 (5 reboot logins ended) - these were probably all marked as "still running" until the event that finally closed them.

Worth considering the time-change possibility anyway.

Why is the output from your zcat not in strict descending chronological order?

Hi hydrurga,

tnx for all the effort of yours.
As far as time-change is concerned I can say that it was Aug 15 that this last happened.

I have got a dual-boot system working here (WIN 8.1 and Lubuntu). I last used Windows on Aug 14 for update purposes and booted into Lubuntu only the following day.
Every time I switch from Windows to Lubuntu the clock is 2 hours fast. After internet-connection is established the time is set right again.

But that was, as I said, on Aug 15. And the last "shutdown"-entry was on Aug 25......

I have no idea. I entered the commands as described.

The hardware clock may still be set incorrectly.

It might be worth setting both Windows to local or UTC (see https://askubuntu.com/questions/8009...-to-windows-10) and seeing if that resolves the problem.

Also, the battery on your hardware clock, if you have one, may be dead or dying (or perhaps the connection is flaky). You might consider replacing it.

*****UPDATE*****

Hi again.

I´m glad to tell that I somehow could get things straight again. But I really don´t know how exactly it worked out.

What I did yesterday was the following:

1.) I booted up WIN. I had a vague feeling that it could have something to do with it......
I realized that the boot process look longer that ususal.

2.) It seemed that a reboot was pending as I got a message from avira (third party software, antivirus) which
told me to reboot. That I did.

3.) After a reboot I used WIN for a while and in the evening I performed a normal shutdown.

4.) The next day (today) I booted up Lubuntu and saw (last -x | grep -E '(reboot)|(shutdown)') that
nothing has changed. Well, I thought, that was to be expected.

5.) So I performed a normal shutdown and the booted up Lubuntu again.
Here are the results:
As can be seen there is a shutdown entry this time and only one still running entry. ;)
I´m so delighted.

I really don´t know whether all this really had something to do with WIN and the fact that there was a reboot pending. After all it was just a wild guess.
But somehow it worked out and the Lubuntu logs display the entries as would be expected.

Thanks hydrurga, pan64 and business_kid for all your help.

Greetings
Rosika :hattip: