18

Last shows "crash" at 12:02 and 14:18, but the system didn't stop working at that time. The reboot at 15:03, on the other hand, was to recover from an actual crash - our system stopped responding at 14:46. Why does last show two "crashes" prior to the actual crash of the machine?

[admin@devbox log]$ last | head
myuser pts/2        myhostname  Wed Sep 28 15:12   still logged in
myuser pts/2        myhostname  Wed Sep 28 15:09 - 15:12  (00:02)
myuser pts/2        myhostname  Wed Sep 28 15:07 - 15:09  (00:01)
myuser pts/1        myhostname  Wed Sep 28 15:06   still logged in
myuser pts/0        myhostname  Wed Sep 28 15:04   still logged in
reboot   system boot  2.6.18-274.el5PA Wed Sep 28 15:03          (00:09)
myuser pts/1        myhostname  Wed Sep 28 14:18 - crash  (00:44)
myuser pts/0        myhostname  Wed Sep 28 12:02 - crash  (03:01)

EDIT: The reboot at 15:03 is real enough - but the two "crash" entries at 14:18 and 12:02 I can't explain.

2
  • 40 minutes ... but that's since the reboot.
    – Kyle
    Sep 28, 2011 at 19:44
  • Ah, sorry. Didn't understand your question. When you said "but the system didn't reboot", I thought you were saying that no reboot happened at all.
    – Mat
    Sep 28, 2011 at 19:52

1 Answer 1

20

last prints crash as the logout time when there is no logout entry in the wtmp database for a user session.

The last entry in last output means that myuser logged in on pts/0 at 12:02 and, when the system crashed between 14:18 and 15:03, that user should be still logged in.

Usually, in wtmp there are two entries for each user session. One for the login time and one for the logout time. When a system crashes, the second entry could be missing. So last supposes that the user was still logged on when the system crashed and prints crash as the logout time.

To be clearer, that two "crash" lines are only the two session that were active when the system crashed around 15:00, not two system crashes.

3
  • Don't I feel rusty now... sure I knew this at some point! Thanks...
    – Kyle
    Sep 28, 2011 at 21:47
  • Does last always print a reboot record after a crash? And is it possible for the user session to crash but the entire OS? Dec 8, 2015 at 11:38
  • 1) Yes, it is. wtmp will record each system boot but the message displayed (by last) is implementation dependent. 2) No, user session cannot crash. A program managing a user session can abnormally end but, in this case, wtmp will simply record a logout.
    – andcoz
    Dec 8, 2015 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .