Sometimes we may want to investigate why a linux system was shutdown unexpectedly .\u00a0<\/p>\r\n\r\n\r\n\r\n
As you know already , the only place we get this information from is \/var\/log directory .<\/p>\r\n\r\n\r\n\r\n
last -x<\/em>\u00a0<\/strong> command will display some information about shutdown\/reboot like below .<\/p>\r\n\r\n\r\n\r\n runlevel (to lvl 3) \u00a0 2.6.32-754.17.1. Sat Sep\u00a0 7 16:24 – 18:41\u00a0 (02:17) \u00a0 \u00a0<\/em><\/strong><\/p>\r\n reboot \u00a0 system boot\u00a0 2.6.32-754.17.1. Sat Sep\u00a0 7 16:24 – 18:41\u00a0 (02:17) \u00a0 \u00a0<\/em><\/strong><\/p>\r\n \r\n\r\n<\/strong><\/p>\r\n \r\n\r\n<\/strong><\/p>\r\n runlevel (to lvl 0) \u00a0 2.6.32-754.17.1. Sat Sep\u00a0 7 14:58 – 16:24\u00a0 (01:26)\u00a0<\/em><\/strong><\/p>\r\n\r\n\r\n\r\n If it is an unexpected shutdown due to power failure or something then you will see just something runlevel (to lvl 0)<\/em><\/strong>\u00a0 . This could be a forceful shutdown . If it is in a datacenter we can ask support team for\u00a0 an explanation .<\/p>\r\n\r\n\r\n\r\n\r\n\r\n This\u00a0 command may display some useful information .<\/p>\r\n\r\n\r\n\r\n grep -iv ‘: starting\\|kernel: .*: Power Button\\|watching system buttons\\|Stopped Cleaning Up\\|Started Crash recovery kernel’ \u00a0 \/var\/log\/messages \/var\/log\/messages \/var\/log\/apcupsd* \u00a0 | grep -iw ‘recover[a-z]*\\|power[a-z]*\\|shut[a-z ]*down\\|rsyslogd\\|ups’<\/strong><\/em><\/p>\r\n\r\n\r\n\r\n <\/p>\r\n\r\n\r\n\r\n \/var\/log\/messages:Sep\u00a0 <\/span>7 16:24:40 localhost kernel: EXT4-fs (md2): INFO: recovery required on readonly filesystem<\/span><\/p>\r\n \/var\/log\/messages:Sep\u00a0 <\/span>7 16:24:40 localhost kernel: EXT4-fs (md2): write access will be enabled during recovery<\/span><\/p>\r\n \/var\/log\/messages:Sep\u00a0 <\/span>7 16:24:40 localhost kernel: EXT4-fs (md2): recovery complete<\/span><\/p>\r\n <\/p>\r\n If the last shutdown was due to crash or power failure\u00a0 then at next successful boot\u00a0 system logs\u00a0 will write something like “recovery required on readonly filesystem” followed by\u00a0 “recovery complete” .<\/span><\/p>\r\n We can know more about power or system health\u00a0 \u00a0If we\u00a0 have KVM access to server and event log is enabled for that .<\/p>\r\n <\/p>\r\n","protected":false},"excerpt":{"rendered":" Sometimes we may want to investigate why a linux system was shutdown unexpectedly .\u00a0 As you know already , the only place we get this information from is \/var\/log directory . last -x\u00a0 command will display some information about shutdown\/reboot like below . runlevel (to lvl 3) \u00a0 2.6.32-754.17.1. Sat […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[1,5,7],"tags":[145,144,143],"yoast_head":"\n