0

Linux system with kernel 4.14.76 and last from util-linux 2.35.1.

I am using last -x reboot shutdown to detect abrupt shutdowns and power loss. To my understanding, a clean reboot should show as a pair of shutdown and reboot entries in wtmp. This is supported by e.g. this article. An ungraceful shutdown or powerless can be inferred thorough sequential reboot entries with no shutdown in between.

However, I am finding that there isn't always a shutdown entry when I run systemctl reboot - I often see sequential reboot entries and user sessions are listed as crash. Sometimes however, we do get both shutdown and reboot entries logged.

Example where I ran systemctl reboot 4 times:

$ last -x reboot shutdown
reboot   system boot  4.14.76-6.1.0-so Wed Aug 31 13:12   still running
shutdown system down  4.14.76-6.1.0-so Wed Aug 31 13:12 - 13:12  (00:00)
reboot   system boot  4.14.76-6.1.0-so Wed Aug 31 12:56 - 13:12  (00:15)
reboot   system boot  4.14.76-6.1.0-so Wed Aug 31 11:24 - 13:12  (01:47)
reboot   system boot  4.14.76-6.1.0-so Wed Aug 31 11:23 - 13:12  (01:48)
shutdown system down  4.14.76-6.1.0-so Wed Aug 31 11:22 - 11:23  (00:00)

I have only found one question that directly addresses this but sadly it is locked behind RHEL subscription.

I am not dual-booting as per this other SE question, which may itself be an instance of inconsistent shutdown logging in wtmp.

Does anyone know why reboots via systemctl would not consistently log shutdown alongside reboot?

Is there a better way to reliably tell whether the system experienced unexpected reboots/power loss?

1 Answer 1

0

The answer for me was this bug ticket where systemd unit dependencies were causing the utmp update service to not get run on shutdown.

By setting the Requisite= directive to blank for the systemd-update-utmp-runlevel.service lastlog does now reliably gain shutdown entries on clean reboots.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .