[SOLVED] According to /var/log/messages the OS was always idle but I know this to be false.

stf92 · 06-21-2011, 02:53 AM

Hi:

Look at this /var/log/messages, if you please:

Code:

Jun 20 04:40:01 darkstar syslogd 1.4.1: restart.
Jun 20 04:54:30 darkstar -- MARK --
Jun 20 06:34:30 darkstar -- MARK --
Jun 20 06:54:30 darkstar -- MARK --
Jun 20 07:14:30 darkstar -- MARK --
............................
Jun 20 14:14:38 darkstar -- MARK --
Jun 20 14:34:38 darkstar -- MARK --
Jun 20 14:54:38 darkstar -- MARK --
Jun 20 15:14:38 darkstar -- MARK --

This is the entire file, except for the dots. The machine had been turned on all night. Then I went to the machine and, first thing I do is
$ less /var/log/messages
$
The file was as above. But I know I was working at it from 7am to 10am at least. This needs clarification:

4:40 I turn on.
up to 6:00 idle
6:00 activity at keyboard
8:00 I leave work at the machine

It's just an example as I don't exactly remember the timing. But according to the entries I was never working.

wildwizard · 06-21-2011, 03:53 AM

Quote:

Originally Posted by stf92

It's just an example as I don't exactly remember the timing. But according to the entries I was never working.

Your usage of the machine doesn't necessarily create log entries, so without a logable event occurring nothing will appear in the logs.

16pide · 06-21-2011, 03:56 AM

/var/log/messages does not log user activity, it logs system events.

view a video and it won't be logged there.
plug a usb stick, and it will be logged
getting a dhcp address will get logged there too

stf92 · 06-21-2011, 04:07 AM

Thank for the posts.
And what is the meaning of -- MARK -- ? This entry means there has been no activity for the last 20m, I think and my experience tells me.

chrisretusn · 06-21-2011, 04:22 AM

Quote:

Originally Posted by stf92

But according to the entries I was never working.

Nope, it simply means that nothing occurred that was worth logging.

MARK is time marker, it tells you the logger is working.

Quote:

Originally Posted by man syslogd

-m interval

The syslogd logs a mark timestamp regularly. The default interval between two -- MARK -- lines is 20 min-
utes. This can be changed with this option. Setting the interval to zero turns it off entirely. Depending
on other log messages generated these lines may not be written consecutively.