when using the "last" command in linux what does crash and down mean
 

I was wondering what it meant when you see crash or down in the "last" output.







root pts/0 *.*.*.* Fri Mar 12 22:09 - crash (00:10)
root tty2 Fri Mar 12 21:47 - crash (00:32)
root tty1 Fri Mar 12 21:45 - crash (00:34)
reboot system boot 2.4.20 Fri Mar 12 21:44 (01:25)
root tty1 Fri Mar 12 21:42 - down (00:00)

down means that you exited a shell gracefully
during a shutdown.
crash - I've never seen that one :)


Cheers,
Tink

Last prints crash as logout time when there is no logout entry in the wtmp database for an user session.

Usually, in wtmp there are two entries for each user session. One for the login time and one for the logout time. When a system crashes, the second entry could be missing. So last supposes that the user was still logged on when the system crashed and prints crash as logout time.

To be more clear, that two "crash" line are only the two session that were active when the system crashed

I'm curious ... what made you unearth this 8 year old corpse of a thread?

I certainly wouldn't characterize the thread as a "corpse" at all, considering that @vikki actually answered the OP's question for the part that remained unanswered.

It was a good answer too, and because the thread was still relevant and also because the information he provided was useful I was able to get the answer to a question I had when Google directed me here to this thread. I searched all over and had @vikki not provided his additional post to this thread I would have been brought to this thread and still not received the answer I was searching for.

BTW, thanks @vikki, and keep up the work as it is much appreciated :)