Detecting a "plug pulled" scenario with Linux

Question

I was wondering if it's possible to detect a shutdown due to power loss on a Linux system. (Power loss defined as: pressing reset button, pressing power button, pulling the power cord) If so, how? (ie, if this is already something that people can do, what commands do I run?)

The way I would imagine something like this working:

• When system comes back up, checks for an issued shutdown or reboot command, finds none.
• System checks for any sort of errors that have been logged that would require a reboot, such as kernel panic, etc (OOM maybe?) and finds none.
• If no smoking gun found as described above, the system logs something like "No cause for shutdown found, potential power loss detected."

Answer 1

It depends on your implementation of last but if your system crashed you'll see a message to this effect in the last output.

Example

Notice the crash lines? These are as a result of the power going out or someone hitting the power switch on this particular system.

$ last
root     pts/0        greeneggs.bubba. Tue May 13 22:42 - 22:43  (00:01)    
reboot   system boot  2.6.18-238.19.1. Tue May 13 21:47         (4+17:29)   
root     pts/0        greeneggs.bubba. Tue May 13 21:36 - crash  (00:11)    
root     pts/0        greeneggs.bubba. Mon May 12 03:29 - 03:29  (00:00)    
root     pts/0        greeneggs.bubba. Sun May 11 16:47 - 19:41  (02:53)    
root     pts/0        greeneggs.bubba. Sat May 10 17:10 - 17:12  (00:01)    
root     pts/0        greeneggs.bubba. Sat May 10 08:35 - 08:35  (00:00)    
root     pts/1        greeneggs.bubba. Thu May  8 23:56 - 23:56  (00:00)    
reboot   system boot  2.6.18-238.19.1. Thu May  8 23:55         (9+15:21)   
root     pts/0        greeneggs.bubba. Thu May  8 22:39 - 22:41  (00:02)    
root     pts/0        greeneggs.bubba. Tue May  6 21:36 - 22:06  (00:30)    
sam      pts/0        byers.bubba.net  Tue May  6 12:36 - 13:04  (00:28)    
root     pts/0        :0.0             Mon May  5 23:12 - 23:12  (00:00)    
root     :0                            Mon May  5 23:03 - crash (3+00:51)   

More esoteric method

One that I've seen used quite well is if you have a laptop, you can use the command line tool acpi to query the system's ACPI interface. This will tell you, among other things, when the system is on-line with power or running off of its battery.

Example

Here's the output from that command on my laptop.

$ acpi -V
Battery 0: Unknown, 94%
Battery 0: design capacity 6963 mAh, last full capacity 6683 mAh = 95%
Adapter 0: on-line
Thermal 0: ok, 52.0 degrees C
Thermal 0: trip point 0 switches to mode critical at temperature 100.0 degrees C
Thermal 0: trip point 1 switches to mode passive at temperature 95.5 degrees C
Cooling 0: LCD 0 of 15
Cooling 1: Processor 0 of 10
Cooling 2: Processor 0 of 10
Cooling 3: Processor 0 of 10
Cooling 4: Processor 0 of 10

Simply checking the contents of the line Adapter will tell the system's current status. This could be wrapped into a monitor, if for example, you wanted to monitor a group of machines to see if they've experienced their power being cut as a group.

plugged in

$ acpi -V | grep "Adapter"
Adapter 0: on-line

unplugged

$ acpi -V | grep "Adapter"
Adapter 0: off-line

Answer 2

You could accomplish this by creating a placeholder file when the system is properly shut down or does a user initiated reboot (init 0 or 6). Run a startup script (init 3 or 5) that checks the existence of the file. If it's missing it didn't shutdown properly. If the file does exist (i.e. the system had a normal shutdown or reboot) simply remove the lock file.

Just make sure you don't write the place holder file to a directory that is mounted in memory (/dev/shm, /var/run, etc..) or /tmp as these directories will be emptied when the system reboots.