How can I find real reason for shutdown.

How can I find real reason for shutdown. Especially I want to find reason that is result of power cut.
I tried “journalctl -r” command and looked at Reboot lines but I didn’t find any specific info.

Please, always explain which version of openSUSE you use.

Sorry.
Opensuse 13.2 64 bit

On 2015-07-10 21:46, fakiradam wrote:
>
> How can I find real reason for shutdown. Especially I want to find
> reason that is result of power cut.
> I tried “journalctl -r” command and looked at Reboot lines but I didn’t
> find any specific info.

If I understand your situation correctly, if the power is cut, there is
no electricity, and the computer goes down in milliseconds. There is no
time to write anything on the log on disk, nothing to read about later.

Unless your machine has an UPS (you have not said) or it is a laptop
with battery (you have not said).


Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

Thank you.
Unfortunetly my machine hasn’t an UPS and isn’t a laptop.
I looked my modem and I found that router has never been closed. So I think the computer was closed by someone.

Actually, I expect to be written a record to a log file when machine starts, If computer isn’t closed normally.

Sorry my English.

On Fri, 10 Jul 2015 21:36:01 +0000, fakiradam wrote:

> Actually, I expect to be written a record to a log file when machine
> starts, If computer isn’t closed normally.
>
> Sorry my English.

Yeah, you would see a log for when it was started up, but as others
indicated, an unexpected shutdown is, well, unexpected - and as such,
there’s no chance to log anything.

You could look in /var/log/messages to find something that indicates when
it started up.

Or you could run ‘uptime’ in a terminal window to see how long the system
has been running (that also could help inform you about what to look for
in the log file).

But none of that will give you a reason for a shutdown, only that the
system started at that point.

Jim


Jim Henderson
openSUSE Forums Administrator
Forum Use Terms & Conditions at http://tinyurl.com/openSUSE-T-C

On 2015-07-10 23:36, fakiradam wrote:
>
> Actually, I expect to be written a record to a log file when machine
> starts, If computer isn’t closed normally.

Yes, you may find indications in the log of the next boot that the machine was not closed properly. You may find entries about the filesystems running an automatic check and repair — try searching for the word fsck from the end back. However, this is not always written to the log, as when it runs the root partition is still mounted read only.

For instance, on this laptop I see:


<0.5> 2015-07-06 22:05:55 minas-tirith kernel - - -   108.632176] REISERFS (device sda8): checking transaction log (sda8)
<0.5> 2015-07-06 22:05:55 minas-tirith kernel - - -   109.088785] REISERFS (device sda8): Using r5 hash to sort names
<0.5> 2015-07-06 22:05:55 minas-tirith kernel - - -   109.319818] REISERFS (device sda8): Removing [4 561022 0x0 SD]..done
<0.5> 2015-07-06 22:05:55 minas-tirith kernel - - -   109.327042] REISERFS (device sda8): Removing [4 561021 0x0 SD]..done
....
<0.5> 2015-07-06 22:05:55 minas-tirith kernel - - -   109.562231] REISERFS (device sda8): There were 18 uncompleted unlinks/truncates. Completed

which I know are entries from repairing the “/home” filesystem. I know that the battery run out the previous time and system went down, so I expected to see that. However, there are other partitions that are ext3 or 4, they also checked, but nothing is logged about them.

However, nothing in the log indicates if the power failed, if somebody pushed the power switch for 5 seconds, or if there was an abrupt software crash.

I know the exact point in the logs where there was a failure:


<3.6> 2015-07-06 21:49:38 minas-tirith avahi-daemon 4733 - -  New relevant interface wlan0.IPv4 for mDNS.
<3.6> 2015-07-06 21:49:38 minas-tirith avahi-daemon 4733 - -  Registering new address record for 192.168.1.129 on wlan0.IPv4.
2015-07-06 22:05:55+02:00 - Booting the system now  ================================================================================  Linux minas-tirith 3.11.10-29-desktop #1 SMP PREEMPT Thu Mar 5 16:24:00 UTC 2015 (338c513) x86_64 x86_64 x86_64 GNU/Linux
<5.6> 2015-07-06 22:05:55 minas-tirith rsyslogd - - -  [origin software="rsyslogd" swVersion="7.4.7" x-pid="1300" x-info="http://www.rsyslog.com"] start

I just have to search for “====”. And as the entry for “halting the system now” is missing, I know that it crashed. But not why. Well, I actually know because I was looking when it happened, but not by looking at the logs.


Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

Check wtmp file. When system is shut down normally it should write “shutdown” record and write “reboot” record when system is booted. Like

bor@opensuse:/tmp> last -x| grep -E shutdown\|reboot
reboot   system boot  3.16.7-21-deskto Sun Jun 28 11:05 - 08:57 (12+21:52)  
shutdown system down  3.16.7-21-deskto Sun Jun 28 10:28 - 11:05  (00:37)    
reboot   system boot  3.16.7-21-deskto Mon Jun 15 18:57 - 10:28 (12+15:30)  
reboot   system boot  3.16.7-21-deskto Sun Jun 14 11:34 - 10:28 (13+22:53)  
shutdown system down  3.16.7-21-deskto Sun Jun 14 10:41 - 11:34  (00:53)    
reboot   system boot  3.16.7-21-deskto Thu Jun 11 18:38 - 10:41 (2+16:02)   
reboot   system boot  3.16.7-21-deskto Tue Jun  9 06:14 - 10:41 (5+04:27)   

If you have “reboot” without “shutdown” it is strong indication that your system was switched off abruptly.

Note that there is some window between writing “shutdown” line and actually cleanly shutting down system, and something bad may still happen, but this is good as starting point.

Yes, logs doesn’t contain “shutdown” at related time and I am sure there was not power cut. I don’t think computer crashed from a program.

Thank you

shutdown system down  3.16.7-21-deskto Fri Jul 10 21:33 - 21:34  (00:00)    
reboot   system boot  3.16.7-21-deskto Fri Jul 10 21:11 - 21:33  (00:22)    
reboot   system boot  3.16.7-21-deskto Wed Jul  8 11:28 - 21:33 (2+10:05)   
reboot   system boot  3.16.7-21-deskto Sat Jul  4 09:53 - 21:33 (6+11:40)   
reboot   system boot  3.16.7-21-deskto Fri Jul  3 21:21 - 21:33 (7+00:11)   

Is last entry really “shutdown”? This is strange, because last entry on a running system should always be “reboot” which is written when system is booted.

I cut the log where I look around. It is not complete list.
Actually I did it deliberately to learn log how is looked when normal shut-down. I am looking around Fri Jul 10 18:00. I was out of office. I tried to connect my computer by teamviewer but I was unsuccessful. So I called my colleague and he answered me happened power cut. I asked neighbourhood and they said power cut was not happened and I looked at modem log that shows how much time is active. It displayed two or three day but I don’t remember exact time between. Because I restarted my modem to learn how is reaction. It showed 1 minute or less. So I am sure there is no power cut.

Sorry my English. Thanks for your reply.