1

Can I find out when an unattended system went down ? I suspect its power was cut.

Context:

I realised I had a few minutes left to catch the train, so I disconnected the mouse, keyboard and monitor from my laptop, shove it in the bag and ran. The next morning I found the laptop dead, while I was expecting it to be in sleep. However, battery was full.

I suspect that I closed the lid before pulling out the monitor cable, so it didn't go to sleep, but kept running. Then it probably overheated in the bag and BIOS cut the power.

I'd be curious to see when it actually went down. I checked the syslog and the last events are the mouse / keyboard disconnection. I also checked the output of last with various parameters, to no avail, because it wasn't a 'planned' shutdown.

I guess my best bet would be to find a program that normally writes or logs often. Firefox used to be one, until I changed it. And I've used Firefox since then anyway, so it would be overwritten.

I'm using Linux Mint 17.2 (Ubuntu 14.04 derivative)

[I realise this question can also be on ServerFault]

Community
  • 1
Ciprian Tomoiagă
  • 345

1 Answers1

3

For unplanned shutdowns (e.g. power cut) the best way is to make syslog log mark messages. These are messages that (e.g.) rsyslog logs periodically to indicate that the system is live. rsyslog for example has the immark module that does this and is smart enough not to log anything if there was already a message logged.

See for example http://www.rsyslog.com/doc/rsconf1_markmessageperiod.html

V13
  • 4,749
  • I guess this doesn't happen by default, so I cannot find it now, only if it happens again in the future, right ? – Ciprian Tomoiagă Oct 16 '16 at 13:59
  • 2
    Yes, if you don't have immark enabled then you won't be able to do so. Unless you were running a program that was periodically saving something on the disk and did not run again after the reboot, or there was a state transition (e.g. thermal event, battery low) that caused a write to the disk, I don't see another way to figure this out. – V13 Oct 16 '16 at 14:02
  • indeed, that's what I figured! THERMAL EVENT! are those logged somewhere? – Ciprian Tomoiagă Oct 16 '16 at 14:05
  • These are logged by the kernel and as such they should be logged in syslog – V13 Oct 16 '16 at 14:58
  • +1 Quite interesting... I even seen the MARKS in syslog, but had no idea there was a module. – Rui F Ribeiro Oct 16 '16 at 15:02