I know this has been more or less asked before but I still don't have any answer.
I started to investigate why on my system (it is a remote machine)
who -b and
uptime gave different results (~3 days for one / 5 days for the other).
Some answers would say that maybe
/var/run/utmp is corrupted. Some other answers would say that the ntp server was launched after the reboot and so the system had to go backwards to set the time.
Here are a few commands I have typed down :
ubuntu@arm:~$ sudo hwclock --show Mon 25 Nov 2013 03:07:02 PM CET -0.464179 seconds ubuntu@arm:~$ uptime 15:08:17 up 3 days, 53 min, 1 user, load average: 0.88, 0.51, 0.41 ubuntu@arm:~$ date Mon Nov 25 15:08:33 CET 2013 ubuntu@arm:~$ who -b system boot 2013-11-20 12:38 ubuntu@arm:~$ last reboot reboot system boot 3.7.10-x9 Wed Nov 20 12:38 - 15:08 (5+02:30) reboot system boot 3.7.10-x9 Wed Nov 20 12:37 - 15:08 (5+02:31) reboot system boot 3.7.10-x9 Thu Nov 7 14:26 - 12:36 (12+22:10) reboot system boot 3.7.10-x9 Thu Nov 7 14:25 - 12:36 (12+22:11) reboot system boot 3.7.10-x9 Thu Nov 7 14:23 - 12:36 (12+22:12) reboot system boot 3.7.10-x9 Thu Nov 7 14:22 - 12:36 (12+22:14) reboot system boot 3.7.10-x9 Tue Nov 5 14:58 - 14:22 (1+23:23) reboot system boot 3.7.10-x9 Sat Nov 2 12:20 - 14:58 (3+02:37) reboot system boot 3.7.10-x9 Sat Nov 2 12:20 - 12:20 (00:00) wtmp begins Sat Nov 2 12:20:00 2013
Notes : the machine is remote/embed in a system. Sometimes the electricity is shut down. The internet connection is very slow (sim card)
1) What does it mean when there are multiple lines for 1 boot ? I would expect all the lines to look like Nov 5, but on the 7th there are 4 lines at almost the same time and the end time is the same for all of them. I would expect 14:22-14:23 (00:01), 14:23-14:25 (00:02), ...
2) If the electricity is turned down and up again, does it count as a reboot ? How does it affect the internal time ? (ntp server stuff)
3) Is there a scenario one can trust for the 2 days difference between uptime and who -b ? My guts tell me that the file
/var/run/utmp can't be corrupted/have permissions errors as no one else than the system use it.
Any help is grandly appreciated