2

I know this has been more or less asked before but I still don't have any answer.

I started to investigate why on my system (it is a remote machine) who -b and uptime gave different results (~3 days for one / 5 days for the other).

Some answers would say that maybe /var/run/utmp is corrupted. Some other answers would say that the ntp server was launched after the reboot and so the system had to go backwards to set the time.

Here are a few commands I have typed down :

ubuntu@arm:~$ sudo hwclock --show
Mon 25 Nov 2013 03:07:02 PM CET  -0.464179 seconds

ubuntu@arm:~$ uptime
15:08:17 up 3 days, 53 min,  1 user,  load average: 0.88, 0.51, 0.41

ubuntu@arm:~$ date
Mon Nov 25 15:08:33 CET 2013

ubuntu@arm:~$ who -b
system boot  2013-11-20 12:38

ubuntu@arm:~$ last reboot
reboot   system boot  3.7.10-x9        Wed Nov 20 12:38 - 15:08 (5+02:30)   
reboot   system boot  3.7.10-x9        Wed Nov 20 12:37 - 15:08 (5+02:31)   
reboot   system boot  3.7.10-x9        Thu Nov  7 14:26 - 12:36 (12+22:10)  
reboot   system boot  3.7.10-x9        Thu Nov  7 14:25 - 12:36 (12+22:11)  
reboot   system boot  3.7.10-x9        Thu Nov  7 14:23 - 12:36 (12+22:12)  
reboot   system boot  3.7.10-x9        Thu Nov  7 14:22 - 12:36 (12+22:14)  
reboot   system boot  3.7.10-x9        Tue Nov  5 14:58 - 14:22 (1+23:23)   
reboot   system boot  3.7.10-x9        Sat Nov  2 12:20 - 14:58 (3+02:37)   
reboot   system boot  3.7.10-x9        Sat Nov  2 12:20 - 12:20  (00:00)    

wtmp begins Sat Nov  2 12:20:00 2013

Notes : the machine is remote/embed in a system. Sometimes the electricity is shut down. The internet connection is very slow (sim card)

Questions :

1) What does it mean when there are multiple lines for 1 boot ? I would expect all the lines to look like Nov 5, but on the 7th there are 4 lines at almost the same time and the end time is the same for all of them. I would expect 14:22-14:23 (00:01), 14:23-14:25 (00:02), ...

2) If the electricity is turned down and up again, does it count as a reboot ? How does it affect the internal time ? (ntp server stuff)

3) Is there a scenario one can trust for the 2 days difference between uptime and who -b ? My guts tell me that the file /var/run/utmp can't be corrupted/have permissions errors as no one else than the system use it.

Any help is grandly appreciated

Ref: Uptime and who -b are showing different times when the system was last booted on Linux

1

the machine is remote/embed in a system.Sometimes the electricity is shut down. The internet connection is very slow

Does the system have a clock and a battery in it?1 A lot of embedded systems don't. If not, this:

Some other answers would say that the ntp server was launched after the reboot and so the system had to go backwards to set the time.

Makes a lot of sense, although probably it's been up for 3 days not 5 (i.e. it went forward). You can confirm this by looking back through syslog -- something you've haven't mentioned, and which will confirm the actual time of the last boot. Unless because it's embedded you don't save logs, which returns us to the very likely scenario of a system without a clock: they don't have the correct time until ntp gets it. The time they do use will probably be in the past; I'm not sure what the mechanism is (maybe a filestamp).

1 If it does: how old is the battery? They do need to be replaced periodically.

  • I actually think it'd be more common to simply initialize the clock to some fixed value until you can get a time from an external source. I do know my Cisco router, which is basically a glorified embedded system running Linux plus some of their proprietary software, does that; it sets the clock to some value (forgot which) and then launches a NTP daemon to set the correct time once networking becomes available. – a CVn Nov 25 '13 at 15:00
  • so my system has no clock nor battery. when it boots the date will be the last one it saw before rebooting. Question 2 still holds : if the electricity is turned down, does it count as a reboot (in who -b) ? – Thomas Nov 25 '13 at 15:04
  • I'm not sure when it will be. I have one system like this and it does always seem to be in the past, but I am pretty sure it is not necessarily the time it shut down. I.e., you could pull the cord for 30 seconds, but when it comes back the time may still be off by days. This is why I'm guessing it checks a timestamp, but which file, I dunno. WRT to rebooting, a power cut is not a formal reboot, but it is a boot, so who -b should recognize that. – goldilocks Nov 25 '13 at 15:08
  • I did an experiment with the machine. I pulled the electric plug (Nov 25) and waited 1 day and a half before plugging it back. Before that the machine was last rebooted on Nov 20, 10:52. Then I checked again. It said that last reboot was Nov 20, 10:53 !!!! Only possibility I can think of : the system saves the date of the last reboot when rebooting cleanly (halt/reboot), and takes that as an input on start. The +1 minute corresponds to the boot time. Does it sound good ? – Thomas Nov 27 '13 at 8:38
  • Makes sense to me! – goldilocks Nov 27 '13 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.