Is there anything in Linux that is constantly logged in relatively often, for example every hour? So that I can estimate the time of a sudden shutdown of my Synology NAS during a power cut. The NAS is using GNU/Linux distro - DiskStation Manager, which is heavily customized Debian fork (if I remember correctly) but maybe there is something general and helpful in that situation.
-
Two periodic logs on my gentoo system: `Oct 12 13:01:01 syl CROND[26156]: (root) CMD (run-parts /etc/cron.hourly)` (hourly) and `Oct 12 13:40:01 syl CROND[12729]: (root) CMD (/usr/lib/sa/sa1 1 1 > /dev/null 2>&1)` (every 10 minutes) – Mark Wagner Oct 12 '20 at 22:06
-
Have you tried a `find /var -mmin -60` to check what got recently modified after the system has been started for a little while? – Ginnungagap Oct 12 '20 at 22:43
-
Your last SMART readout might have a precise monotonic uptime counter, subtract the disks counters delta from the time delta between querying the SMART data, thats your downtime. – anx Oct 15 '20 at 18:44
3 Answers
I can't reply for Synology. But it's quite common for Linux distros to have syslogd/rsyslogd installed with a default configuration that insert lines like this in /var/log/messages
:
Oct 11 23:58:48 harpe pppd[17995]: Exit.
Oct 12 00:16:08 harpe -- MARK --
Oct 12 00:36:08 harpe -- MARK --
Oct 12 00:56:08 harpe -- MARK --
Oct 12 01:16:08 harpe -- MARK --
Oct 12 01:36:08 harpe -- MARK --
Oct 12 01:56:08 harpe -- MARK --
Oct 12 02:16:08 harpe -- MARK --
So at least you have a maximal 20 minutes time window between entries in the logs.
Silly me, I forgot the obvious answer: depending upon your journalctl
configuration, the command may remember a number of boots, and also the time of shutdown (even in case of unplanned, forced shutdown) :
journalctl --list-boots
-3 ecfdfe641836413e8a6e5485e897fb09 Sun 2020-09-20 10:51:13 CEST—Thu 2020-10-01 12:59:33 CEST
-2 940f4faaa25942d18315ea6534f76c5e Thu 2020-10-01 13:00:07 CEST—Tue 2020-10-13 10:46:14 CEST
-1 9ad55bd7ab9a488fb76ace33915169cf Tue 2020-10-13 10:55:55 CEST—Wed 2020-10-14 10:26:12 CEST
0 785a86203ec042dbb6ad8959166b0584 Wed 2020-10-14 10:34:26 CEST—Thu 2020-10-15 19:34:39 CEST
![](../../users/profiles/10310.webp)
- 6,782
- 4
- 30
- 62
-
Thanks. I checked this file, but unfortunately there are no regular entries in it. – bLAZ Oct 12 '20 at 17:22
-
Your Synology is a linux based system. Which one I do not remember but that's not that important.
For that or any linux system, you want to review date & time of some reliable service in linux. The most reliable is probably auditd however you have to have that configured and running. If it is then you would look through /var/log/audit/audit.log
and identify a gap in time followed by the expected sequence of messages that happen on power up. That is what would define your scenario of unexpected shut down.
For Synology, while based on linux, it is however the synology folks decided to configure their DSM (disk station manager) operating system which is realistically nothing more than how they have configured linux to operate the way they want it to with all their software piled on top of [debian] linux.
The other most likely thing to use in any linux is the /var/log/messages
. I am not aware of anyone that's configured a reasonable distribution of linux where the messages file was not in use. In this you'll see many items per minute, so it should be quite easy and obvious to identify a time gap followed by what is normally seen in that file for a power on.
Synology DSM has a bunch of useful things in their control panel, it will have stated the date & time a power outage would have happened. I have a bunch of them, and their info log plainly states when the thing has been powered down normally or when the power cord was yanked from it. My guess is Synology's DSM parses audit.log or messages to make that determination.
![](../../users/profiles/366512.webp)
- 775
- 3
- 9
- 19
Why wouldn't the shutdown message not be in
/var/log/messages
as well last
will show when it went down.
I would look for when it comes back up and look in the log right before there.
![](../../users/profiles/515031.webp)
- 211
- 1
- 5