How can I detect boot and shutdown times from logs?

RichardBronosky · 02-26-2007, 06:18 PM

I'm specifically interested in Debian and Ubuntu. I'd like to know where to look and what to look for. I want to write a shell script the will SED (I'm not fond of AWK) some logs and give a list of startup, shutdown, reboot, hibernate, and wake times. I'd like to have a rough idea of how many hours I am spending at work. I know that I always do one of these when arriving or departing. If I could get a list of times, I could infer which where which.

For extra credit, how can I get a list of Screen Saver start and stop times and screen lock and unlock times?

I realize that I could add items to my /etc/rc2.d/ and /etc/rc6.d for startup and shutdown respectively, but I suspect that I would be recreating something that is already logged.

Please advise.

Matir · 02-26-2007, 07:33 PM

Look at 'last'. It logs system boots and (intentional) shutdowns. No such luck with suspend or hibernate, though if you execute those with sudo, they'd be logged in /var/log. (Exactly which log depends on your syslog configuration).

RichardBronosky · 02-26-2007, 10:53 PM

ROCK! That's what I needed. I knew about last... sort of. I thought it was only the last login that was stored. Ooops.

Anyway this is what I'm going with:

Code:

last | \
tac | \
sed '/boot/!d;/Mon\|Tue\|Wed\|Thu\|Fri/!d;/\(1[7-9]\|2.\):.. -/d;'

I'll break it down for those just slightly more newb than I. I put it on 3 lines here for the ease of explanation. I used "trailing slash notation" so that it is actually copy and paste-able. When I use it, though, I have it al on one line minus the slashes that are shown at the end of lines 1 and 2. Here what this script does:

Line 1: run the utility called "last" (see "man last" for more info) and pipe it to "sed" on Line 2.
Line 2: receives the output piped from Line 1 and runs "tac" on it, which reverses the input (from file names passed as arguements or from STDIN when piped) Notice that "tac" is "cat" backward.
Line 3: (this is the workhorse) sed is one of those tools that you just have to start using before you understand it. My sed line consists of 3 commands separated by semicolons. This is what they do:
/boot/!d; - This matches (/boot/)lines that contain "boot" and performs a (!d) "do not delete" (which implies delete the others)
/Mon\|Tue\|Wed\|Thu\|Fri/!d; - Matches lines with these days of the week in them and deletes the others
/\(1[7-9]\|2.\):.. -/d; - matches lines that have a beginning times of "17:nn -" through "2n:nn -" and deletes them.

This doesn't try to do any summing or anything. That would be too prone to error, so I do that myself with "dc" you handy "Reverse Polish Notation" calculator. (Yes, Bronosky is Polish.)

Enjoy.