Ubuntu, last logs

alex0009 · 03-15-2024, 05:16 AM

Hi All.
Here is terminal output after "last"

Code:

alex     tty2         tty2             Sun May 29 14:34 - down  (20+15:14)
reboot   system boot  5.13.0-44-generi Sun May 29 14:34 - 05:48 (20+15:14)
alex     tty2         tty2             Sun Mar 27 11:54 - down  (63+02:38)
reboot   system boot  5.13.0-35-generi Sun Mar 27 10:29 - 14:33 (63+04:03)
alex     tty2         tty2             Sat Mar 12 19:21 - crash (14+14:08)
reboot   system boot  5.13.0-35-generi Sat Mar 12 19:20 - 14:33 (77+18:12)
alex     tty2         tty2             Wed Feb 23 08:34 - crash (17+10:46)
reboot   system boot  5.13.0-30-generi Mon Jan 10 05:07 - 14:33 (139+08:25)
alex     tty2         tty2             Sun Feb 20 15:42 - crash (-41+10:34)
reboot   system boot  5.13.0-28-generi Sun Feb 20 15:42 - 14:33 (97+21:51)
alex     tty2         tty2             Sun Feb 20 15:36 - crash  (00:05)

What scenarios can you suggest other than aliens if:
- This is not my computer, but I have it now, and line

Code:

reboot   system boot  5.13.0-35-generi Sat Mar 12 19:20 - 14:33 (77+18:12)

is the date and time when I opened the laptop lid for the first time, I had a password, since I am a relative of the owner of the computer.
Please pay attention to line

Code:

reboot   system boot  5.13.0-30-generi Mon Jan 10 05:07 - 14:33 (139+08:25)

,
where there is a strange date. Mainly I'm interested in how such a record with such a date could appear (except for aliens). Any other scenarios are acceptable, both with the participation of the owner of the computer, and with the participation of a neighbor while the owner was sleeping. Let me remind you that I am not the owner of the computer, but the interested party- relative of the owner.
Any opinions are welcome.

jayjwa · 03-15-2024, 05:00 PM

All the crashes indicate the system is not stable. It's possible the time got messed up due to any number of reasons, such as a flakey ntpd, a garbed config file for said, misuse of "date" or "hwclock", or a failing battery. When the battery was replaced, it started working correctly again. The aliens explaination sounds more fun though.

alex0009 · 03-16-2024, 02:29 AM

Quote:

Originally Posted by jayjwa

All the crashes indicate the system is not stable. It's possible the time got messed up due to any number of reasons, such as a flakey ntpd, a garbed config file for said, misuse of "date" or "hwclock", or a failing battery. When the battery was replaced, it started working correctly again. The aliens explaination sounds more fun though.

Ok, accepted. But how can the absence of an authorized login be explained by this strange date?
After all, always after the "reboot"- user , the next line is the authorized login. Or am I missing something?

lvm_ · 03-16-2024, 04:55 AM

These crashes are not necessarily crashes. In the output of last 'crash' means that there is a login event in wtmp but no corresponding logout event which may be caused by any kind of improper shutdown. BTW the better way to examine wtmp is utmpdump, it gives more detail. Examining /var/log/syslog or systemd journal is even better.

alex0009 · 03-16-2024, 12:27 PM

Quote:

Originally Posted by lvm_

BTW the better way to examine wtmp is utmpdump, it gives more detail. Examining /var/log/syslog or systemd journal is even better.

Unfortunately, nothing new. There is no data here for such an ancient period.

We see the "reboot"-user, but we don’t see the login. Maybe single-user login or another login mode? What options?

MadeInGermany · 03-18-2024, 08:42 AM

Obviously there was a big leap backwards in time. Only this can explain the -41 days uptime.

Code:

alex     tty2         tty2             Sun Feb 20 15:42 - crash (-41+10:34)

reboot is not a user. The system simply makes an entry when it boots.

pan64 · 03-18-2024, 08:51 AM

yes, reboot is not a user, just a marker.
The times are really strange. I think you need to check the logs. It jumped back and forth 41 days and also crashed several times. Extra heat, aliens, dead battery or the neighbor's cat.

alex0009 · 03-18-2024, 01:48 PM

Quote:

Originally Posted by pan64

I think you need to check the logs.

A lot of time has passed since then, there are simply no syslogs and others
If someone suggested, for example, using the commands find, ls and others, using a certain mask, to look for certain files that could draw unambiguous conclusions, then that would be great.

2 years ago, there was an opportunity, and I searched through the find for files with different attributes (creation, modified, changed, etc.), during this interesting period. But I don’t have enough knowledge to draw conclusions.

pan64 · 03-19-2024, 01:39 AM

in that case I think you need to wait for the next visit of those aliens.