LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   want to know about "last" command (https://www.linuxquestions.org/questions/linux-newbie-8/want-to-know-about-last-command-4175493500/)

sachin.davra 02-03-2014 12:05 AM
want to know about "last" command
 
Code:
reboot  system boot  2.6.32-358.el6.x Mon Feb  3 09:27 - 11:32  (02:05)
what does the above line say.

shivaa 02-03-2014 12:31 AM
This line says about the last reboot of your system and this output was possibly generated using cmd last reboot. However, as last commands's manual says, it gives a list of last logged in users. Moreover, by using cmd line options, other info. can also be retrieved. Check out man page.

sachin.davra 02-03-2014 12:36 AM
Quote:
Originally Posted by shivaa (Post 5110076)
This line says about the last reboot of your system and this output was possibly generated using cmd last reboot. However, as last commands's manual says, it gives a list of last logged in users. Moreover, by using cmd line options, other info. can also be retrieved. Check out man page.
How to know when it came up?

shivaa 02-03-2014 12:45 AM
Explain your question little more and before asking, mention that what cmd you had invoked which producted above result? However, to know last reboot time, you can try following cmds:
Code:
user@system~$ who -b
OR
user@system~$ last reboot | head -1
Also, check out last cmd main page for detailed info.

sachin.davra 02-03-2014 12:48 AM
Quote:
Originally Posted by shivaa (Post 5110084)
Explain your question little more and before asking, mention that what cmd you had invoked which producted above result? However, to know last reboot time, you can try following cmds:
Code:
~$ who -b
~$ last reboot | head -1
Also, check out last cmd main page for detailed info.
Sorry for inconveninence. My senior told me that this server restarted at 9:27. find the reason for that.

I want to know when it was down and at what time it came up. and reason for that. and how it was done automatically.

shivaa 02-03-2014 01:08 AM
Alright, in that case you should check system logs on that particular time. You can check under /var/log/messages. BTW, which system/OS it is?

sachin.davra 02-03-2014 01:11 AM
Quote:
Originally Posted by shivaa (Post 5110099)
Alright, in that case you should check system logs on that particular time. You can check under /var/log/messages. BTW, which system/OS it is?
It is CentOS 6. I think in /var/log/messages, i will not get anything because i think it was rebooted by tripping the ups. What should i try to find the answers asked by me in previous section.

I have added output of last command.
Quote:
Quote:
root pts/0 gaidl-5001.gai.n Mon Feb 3 09:30:56 2014 - Mon Feb 3 09:33:35 2014 (00:02)
reboot system boot 2.6.32-358.el6.x Mon Feb 3 09:27:37 2014 - Mon Feb 3 12:42:47 2014 (03:15)
root pts/6 192.168.50.3 Sat Feb 1 22:29:07 2014 - down (00:01)
root pts/5 192.168.3.4 Sat Feb 1 22:29:07 2014 - down (00:01)
root pts/3 192.168.3.4 Sat Feb 1 22:18:52 2014 - down (00:11)
root pts/2 192.168.3.4 Sat Feb 1 22:13:39 2014 - down (00:16)
root pts/3 192.168.3.4 Sat Feb 1 19:29:42 2014 - Sat Feb 1 20:17:05 2014 (00:47)
root pts/2 192.168.3.4 Sat Feb 1 18:37:05 2014 - Sat Feb 1 22:12:51 2014 (03:35)
root pts/2 gaidl-5001.gai.n Sat Feb 1 18:18:24 2014 - Sat Feb 1 18:19:11 2014 (00:00)
root pts/4 192.168.3.4 Sat Feb 1 18:16:01 2014 - Sat Feb 1 22:13:41 2014 (03:57)

shivaa 02-03-2014 02:45 AM
Quote:
Originally Posted by sachin.davra (Post 5110100)
I think in /var/log/messages, i will not get anything because i think it was rebooted by tripping the ups.
First thing, last cmd can give you the reboot time, but not it's reason.
Second, how can you say that you won't get anything in /var/log/messages?
Did you check other log files like /var/log/syslog or cmd like dmesg?
On the other hand, when you know the reason for reboot (tripping the ups), then why you need to find it in log files?
Also, did you read manual of last cmd and analyzed log files?

I guess, your senior wants you to learn things instead of asking people to give you a readymade solution. So, as said, before asking same thing again and again, read man pages and log files or dig over Internet. It will help you.

sachin.davra 02-03-2014 03:01 AM
Quote:
Originally Posted by shivaa (Post 5110148)
First thing, last cmd can give you the reboot time, but not it's reason.
Second, how can you say that you won't get anything in /var/log/messages?
Did you check other log files like /var/log/syslog or cmd like dmesg?
On the other hand, when you know the reason for reboot (tripping the ups), then why you need to find it in log files?
Also, did you read manual of last cmd and analyzed log files?

I guess, your senior wants you to learn things instead of asking people to give you a readymade solution. So, as said, before asking same thing again and again, read man pages and log files or dig over Internet. It will help you.
In /var/log/messages i got only
Code:
Feb  1 23:46:25 localhost kernel: type=1305 audit(1391278585.393:56542): audit_pid=0 old=3043 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Feb  1 23:46:25 localhost kernel: type=1305 audit(1391278585.495:56543): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=
1
Feb  1 23:46:25 localhost kernel: Kernel logging (proc) stopped.
Feb  1 23:46:25 localhost rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="2508" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb  3 09:27:43 localhost kernel: imklog 5.8.10, log source = /proc/kmsg started.
Feb  3 09:27:43 localhost rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="2514" x-info="http://www.rsyslog.com"] start
syslog is not configured here. i think that's why i did not find /var/log/syslog file.
In dmesg how can i be sure about the problem because it builts when system boots. and it doesn't show the timing also.


All times are GMT -5. The time now is 09:14 AM.