want to know about "last" command

sachin.davra · 02-03-2014, 12:05 AM

Code:

reboot   system boot  2.6.32-358.el6.x Mon Feb  3 09:27 - 11:32  (02:05)

what does the above line say.

shivaa · 02-03-2014, 12:31 AM

This line says about the last reboot of your system and this output was possibly generated using cmd last reboot. However, as last commands's manual says, it gives a list of last logged in users. Moreover, by using cmd line options, other info. can also be retrieved. Check out man page.

sachin.davra · 02-03-2014, 12:36 AM

Quote:

Originally Posted by shivaa

This line says about the last reboot of your system and this output was possibly generated using cmd last reboot. However, as last commands's manual says, it gives a list of last logged in users. Moreover, by using cmd line options, other info. can also be retrieved. Check out man page.

How to know when it came up?

shivaa · 02-03-2014, 12:45 AM

Explain your question little more and before asking, mention that what cmd you had invoked which producted above result? However, to know last reboot time, you can try following cmds:

Code:

user@system~$ who -b
OR
user@system~$ last reboot | head -1

Also, check out last cmd main page for detailed info.

sachin.davra · 02-03-2014, 12:48 AM

Quote:

Originally Posted by shivaa

Explain your question little more and before asking, mention that what cmd you had invoked which producted above result? However, to know last reboot time, you can try following cmds:

Code:

~$ who -b
~$ last reboot | head -1

Also, check out last cmd main page for detailed info.

Sorry for inconveninence. My senior told me that this server restarted at 9:27. find the reason for that.

I want to know when it was down and at what time it came up. and reason for that. and how it was done automatically.

shivaa · 02-03-2014, 01:08 AM

Alright, in that case you should check system logs on that particular time. You can check under /var/log/messages. BTW, which system/OS it is?

sachin.davra · 02-03-2014, 01:11 AM

Quote:

Originally Posted by shivaa

Alright, in that case you should check system logs on that particular time. You can check under /var/log/messages. BTW, which system/OS it is?

It is CentOS 6. I think in /var/log/messages, i will not get anything because i think it was rebooted by tripping the ups. What should i try to find the answers asked by me in previous section.

I have added output of last command.

Quote:

root pts/0 gaidl-5001.gai.n Mon Feb 3 09:30:56 2014 - Mon Feb 3 09:33:35 2014 (00:02)
reboot system boot 2.6.32-358.el6.x Mon Feb 3 09:27:37 2014 - Mon Feb 3 12:42:47 2014 (03:15)
root pts/6 192.168.50.3 Sat Feb 1 22:29:07 2014 - down (00:01)
root pts/5 192.168.3.4 Sat Feb 1 22:29:07 2014 - down (00:01)
root pts/3 192.168.3.4 Sat Feb 1 22:18:52 2014 - down (00:11)
root pts/2 192.168.3.4 Sat Feb 1 22:13:39 2014 - down (00:16)
root pts/3 192.168.3.4 Sat Feb 1 19:29:42 2014 - Sat Feb 1 20:17:05 2014 (00:47)
root pts/2 192.168.3.4 Sat Feb 1 18:37:05 2014 - Sat Feb 1 22:12:51 2014 (03:35)
root pts/2 gaidl-5001.gai.n Sat Feb 1 18:18:24 2014 - Sat Feb 1 18:19:11 2014 (00:00)
root pts/4 192.168.3.4 Sat Feb 1 18:16:01 2014 - Sat Feb 1 22:13:41 2014 (03:57)

shivaa · 02-03-2014, 02:45 AM

Quote:

Originally Posted by sachin.davra

I think in /var/log/messages, i will not get anything because i think it was rebooted by tripping the ups.

First thing, last cmd can give you the reboot time, but not it's reason.
Second, how can you say that you won't get anything in /var/log/messages?
Did you check other log files like /var/log/syslog or cmd like dmesg?
On the other hand, when you know the reason for reboot (tripping the ups), then why you need to find it in log files?
Also, did you read manual of last cmd and analyzed log files?

I guess, your senior wants you to learn things instead of asking people to give you a readymade solution. So, as said, before asking same thing again and again, read man pages and log files or dig over Internet. It will help you.

sachin.davra · 02-03-2014, 03:01 AM

Quote:

Originally Posted by shivaa

First thing, last cmd can give you the reboot time, but not it's reason.
Second, how can you say that you won't get anything in /var/log/messages?
Did you check other log files like /var/log/syslog or cmd like dmesg?
On the other hand, when you know the reason for reboot (tripping the ups), then why you need to find it in log files?
Also, did you read manual of last cmd and analyzed log files?

I guess, your senior wants you to learn things instead of asking people to give you a readymade solution. So, as said, before asking same thing again and again, read man pages and log files or dig over Internet. It will help you.

In /var/log/messages i got only

Code:

Feb  1 23:46:25 localhost kernel: type=1305 audit(1391278585.393:56542): audit_pid=0 old=3043 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Feb  1 23:46:25 localhost kernel: type=1305 audit(1391278585.495:56543): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=
1
Feb  1 23:46:25 localhost kernel: Kernel logging (proc) stopped.
Feb  1 23:46:25 localhost rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="2508" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb  3 09:27:43 localhost kernel: imklog 5.8.10, log source = /proc/kmsg started.
Feb  3 09:27:43 localhost rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="2514" x-info="http://www.rsyslog.com"] start

syslog is not configured here. i think that's why i did not find /var/log/syslog file.
In dmesg how can i be sure about the problem because it builts when system boots. and it doesn't show the timing also.