Всех приветствую, подскажите, казалось бы простой вопрос, но выводы разных команд неоднозначные. Надо выяснить время последней загрузки системы и её причины (самопроизвольной перезагрузки) Т.к. имеется машина с Debian 11, и она иногда самопроизвольно перезагружается, последняя перезагрузка была сегодня ночью, 22.12.2022 то есть, пытаюсь выяснить точное время перезагрузки, фактически этим временем будет время загрузки до момента запуска системы: Выполняю:
$uptime -s
2022-12-22 01:52:05
$ who -b
system boot 2022-12-22 04:52
$ last -x | head | tac
reboot system boot 5.10.0-18-amd64 Sat Dec 17 22:35 - 19:35 (-2:59)
runlevel (to lvl 5) 5.10.0-18-amd64 Sat Dec 17 19:35 - 19:35 (00:00)
user tty7 :0 Sat Dec 17 19:35 - 19:35 (00:00)
shutdown system down 5.10.0-18-amd64 Sat Dec 17 19:35 - 22:07 (3+02:32)
reboot system boot 5.10.0-18-amd64 Tue Dec 20 22:07 still running
runlevel (to lvl 5) 5.10.0-18-amd64 Tue Dec 20 19:08 - 01:52 (1+06:44)
user tty7 :0 Tue Dec 20 19:08 - crash (1+09:43)
reboot system boot 5.10.0-18-amd64 Thu Dec 22 04:52 still running
user tty7 :0 Thu Dec 22 01:52 still logged in
runlevel (to lvl 5) 5.10.0-18-amd64 Thu Dec 22 01:52 still running
$last reboot
reboot system boot 5.10.0-18-amd64 Thu Dec 22 04:52 still running
reboot system boot 5.10.0-18-amd64 Tue Dec 20 22:07 still running
reboot system boot 5.10.0-18-amd64 Sat Dec 17 22:35 - 19:35 (-2:59)
reboot system boot 5.10.0-18-amd64 Thu Dec 15 15:50 - 19:26 (2+03:36)
reboot system boot 5.10.0-18-amd64 Tue Dec 13 21:31 - 12:49 (1+15:18)
reboot system boot 5.10.0-18-amd64 Sun Dec 11 09:32 - 08:10 (-1:22)
reboot system boot 5.10.0-18-amd64 Sat Dec 10 22:27 - 06:20 (07:53)
reboot system boot 5.10.0-18-amd64 Sat Dec 10 22:26 - 19:27 (-2:59)
reboot system boot 5.10.0-18-amd64 Fri Dec 9 18:29 - 19:27 (1+00:58)
Ввожу journalctl --list-boots и получаю :
$journalctl --list-boots
-7 87dfc57ca71c4222bef22bfa5dbae479 Fri 2022-12-09 18:30:00 MSK—Sat 2022-12-10 19:24:57 MSK
-6 64c776f2b80c428da59decdf072c6ef5 Sat 2022-12-10 19:28:23 MSK—Sun 2022-12-11 06:20:53 MSK
-5 74197b0e4b374149be74c7ec044be8fe Sun 2022-12-11 06:35:30 MSK—Sun 2022-12-11 08:10:15 MSK
-4 3fa332231dcd483681012600fb04e009 Wed 2022-12-14 09:21:51 MSK—Thu 2022-12-15 12:49:20 MSK
-3 30f364131acb45b793dcafd8c908de6c Thu 2022-12-15 12:50:22 MSK—Sat 2022-12-17 19:26:46 MSK
-2 7a43f3e651f04f0ba38ea2a1523a2a64 Sat 2022-12-17 19:35:18 MSK—Sat 2022-12-17 19:35:35 MSK
-1 dde5f76cb00a4bcc9a2eaf80a5bc1bba Tue 2022-12-20 19:08:15 MSK—Wed 2022-12-21 05:32:31 MSK
0 3156e721dffc49ee95e72f197ab74fa4 Thu 2022-12-22 01:52:31 MSK—Thu 2022-12-22 11:02:01 MSK
Далее, надо почитать логи системных журнал, что происходило перед перезагрузкой, нагуглил команду:
sudo grep -iv ': starting\|kernel: .*: Power Button\|watching system buttons\|Stopped Cleaning Up\|Started Crash recovery kernel' \
/var/log/messages /var/log/syslog /var/log/apcupsd* \
| grep -iw 'recover[a-z]*\|power[a-z]*\|shut[a-z ]*down\|rsyslogd\|ups'
/var/log/messages:Dec 20 19:18:12 MyComp rsyslogd: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="879" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
/var/log/messages:Dec 22 01:52:20 MyComp rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2102.0]
/var/log/messages:Dec 22 01:52:20 MyComp rsyslogd: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="878" x-info="https://www.rsyslog.com"] start
/var/log/messages:Dec 22 01:52:20 MyComp kernel: [ 0.422404] pci 0000:2e:00.1: D0 power state depends on 0000:2e:00.0
/var/log/messages:Dec 22 01:52:20 MyComp kernel: [ 5.947647] usb: port power management may be unreliable
/var/log/messages:Dec 22 01:52:20 MyComp kernel: [ 6.320560] [drm] add ip block number 5 <powerplay>
/var/log/messages:Dec 22 01:52:20 MyComp kernel: [ 7.550767] raid6: using avx2x2 recovery algorithm
/var/log/syslog:Dec 20 19:08:12 MyComp systemd[1]: rsyslog.service: Sent signal SIGHUP to main process 879 (rsyslogd) on client request.
/var/log/syslog:Dec 20 19:08:23 MyComp dbus-daemon[874]: [system] Activating via systemd: service name='org.freedesktop.UPower' unit='upower.service' requested by ':1.45' (uid=1000 pid=2000 comm="mate-power-manager ")
/var/log/syslog:Dec 20 19:08:24 MyComp systemd[1]: Started Daemon for power management.
/var/log/syslog:Dec 20 19:18:12 MyComp rsyslogd: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="879" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
/var/log/syslog:Dec 22 01:52:20 MyComp systemd[1]: Finished Update UTMP about System Boot/Shutdown.
/var/log/syslog:Dec 22 01:52:20 MyComp rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2102.0]
/var/log/syslog:Dec 22 01:52:20 MyComp rsyslogd: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="878" x-info="https://www.rsyslog.com"] start
/var/log/syslog:Dec 22 01:52:20 MyComp kernel: [ 0.422404] pci 0000:2e:00.1: D0 power state depends on 0000:2e:00.0
/var/log/syslog:Dec 22 01:52:20 MyComp kernel: [ 5.947647] usb: port power management may be unreliable
/var/log/syslog:Dec 22 01:52:20 MyComp kernel: [ 6.320560] [drm] add ip block number 5 <powerplay>
/var/log/syslog:Dec 22 01:52:20 MyComp kernel: [ 7.550767] raid6: using avx2x2 recovery algorithm
/var/log/syslog:Dec 22 01:52:37 MyComp dbus-daemon[873]: [system] Activating via systemd: service name='org.freedesktop.UPower' unit='upower.service' requested by ':1.45' (uid=1000 pid=2000 comm="mate-power-manager ")
/var/log/syslog:Dec 22 01:52:38 MyComp systemd[1]: Started Daemon for power management.
grep: /var/log/apcupsd*: No such file or directory
Смотрю инфу по последней загрузке с номером 0:
$journalctl -b -0 -n
Hint: You are currently not seeing userssages from other users and the system.
Users in groups 'adm', 'systemd-journal' can see all userssages.
Pass -q to turn off this notice.
-- Journal begins at Fri 2022-12-09 18:30:00 MSK, ends at Thu 2022-12-22 11:02:01 MSK. --
Dec 22 06:49:28 MyComp sudo[7677]: user : TTY=pts/1 ; PWD=/houser/user ; USER=root ; COMMAND=/usr/bin/cat /var/log/userssages
Dec 22 06:49:28 MyComp sudo[7677]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
Dec 22 06:49:28 MyComp sudo[7677]: pam_unix(sudo:session): session closed for user root
Dec 22 06:52:08 MyComp sudo[7782]: user : TTY=pts/0 ; PWD=/houser/user ; USER=root ; COMMAND=/usr/sbin/ip a show enp41s0
Dec 22 06:52:08 MyComp sudo[7782]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
Dec 22 06:52:08 MyComp sudo[7782]: pam_unix(sudo:session): session closed for user root
Dec 22 09:45:30 MyComp mate-screensaver-dialog[9668]: gkr-pam: unlocked login keyring
Dec 22 11:02:01 MyComp sudo[11078]: user : TTY=pts/0 ; PWD=/houser/user ; USER=root ; COMMAND=/usr/bin/grep -iv : starting\|kernel: .*: Powe>
Dec 22 11:02:01 MyComp sudo[11078]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
Dec 22 11:02:01 MyComp sudo[11078]: pam_unix(sudo:session): session closed for user root
Да и просто смотрю журналы /var/log/messages, /var/log/kern.log и вижу
$sudo cat /var/log/messages
[sudo] password for root:
Dec 20 19:08:26 MyComp clock-applet[2071]: Negative content width -7 (allocation 1, extents 4x4) while allocating gadget (node button, owner GtkToggleButton)
Dec 20 19:08:51 MyComp xdg-desktop-por[1842]: Failed to get application states: GDBus.Error:org.freedesktop.portal.Error.Failed: Could not get window list
Dec 20 19:18:12 MyComp rsyslogd: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="879" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
Dec 21 00:00:48 MyComp kernel: [17586.682274] audit: type=1400 audit(1671570048.775:24): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=5195 comm="cupsd" capability=12 capname="net_admin"
Dec 21 00:01:28 MyComp kernel: [17626.745012] audit: type=1400 audit(1671570088.835:25): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=5197 comm="cups-browsed" capability=23 capname="sys_nice"
Dec 21 05:28:43 MyComp kernel: [37261.703147] [drm] fb mappable at 0xE1200000
Dec 21 05:28:43 MyComp kernel: [37261.703150] [drm] vram apper at 0xE0000000
Dec 21 05:28:43 MyComp kernel: [37261.703151] [drm] size 8294400
Dec 21 05:28:43 MyComp kernel: [37261.703153] [drm] fb depth is 24
Dec 21 05:28:43 MyComp kernel: [37261.703153] [drm] pitch is 7680
Dec 21 05:28:43 MyComp kernel: [37261.703277] fbcon: amdgpudrmfb (fb0) is primary device
Dec 21 05:28:43 MyComp kernel: [37261.703387] Console: switching to colour frame buffer device 240x67
Dec 21 05:28:43 MyComp kernel: [37261.703395] amdgpu 0000:2e:00.0: [drm] fb0: amdgpudrmfb frame buffer device
Dec 21 05:37:40 MyComp kernel: [37798.835299] SUPR0GipMap: fGetGipCpu=0x2b
Dec 21 05:37:47 MyComp kernel: [37805.027221] vboxdrv: 00000000fc07f41e VMMR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.362367] vboxdrv: 0000000068fdb87d VBoxDDR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.499046] VBoxNetFlt: attached to 'enp41s0' / 30:9c:23:62:5e:a1
Dec 21 05:37:47 MyComp kernel: [37805.516529] vboxdrv: 00000000b19f47ca VBoxEhciR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.518098] VMMR0InitVM: eflags=246 fKernelFeatures=0x0 (SUPKERNELFEATURES_SMAP=0)
Dec 21 05:37:47 MyComp kernel: [37805.606669] device enp41s0 entered promiscuous mode
Dec 22 00:00:49 MyComp kernel: [103987.002807] audit: type=1400 audit(1671656449.098:26): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=19437 comm="cupsd" capability=12 capname="net_admin"
Dec 22 00:01:29 MyComp kernel: [104027.089147] audit: type=1400 audit(1671656489.186:27): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=19439 comm="cups-browsed" capability=23 capname="sys_nice"
Dec 22 01:52:20 MyComp kernel: [ 0.000000] Linux version 5.10.0-18-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP Debian 5.10.140-1 (2022-09-02)
Dec 22 01:52:20 MyComp kernel: [ 0.000000] Command line: BOOT_IMAGE=/@rootfs/boot/vmlinuz-5.10.0-18-amd64 root=UUID=dd3958da-6ee7-4325-a713-325a05c60367 ro rootflags=subvol=@rootfs quiet
Dec 22 01:52:20 MyComp kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Dec 22 01:52:20 MyComp kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Dec 22 01:52:20 MyComp kernel: [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Dec 22 01:52:20 MyComp kernel: [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
Dec 22 01:52:20 MyComp kernel: [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-provided physical RAM map:
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000000a0000-0x00000000000fffff] reserved
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x0000000009d7ffff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x0000000009d80000-0x0000000009ffffff] reserved
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x000000000a000000-0x000000000a1fffff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x000000000a200000-0x000000000a20afff] ACPI NVS
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x000000000a20b000-0x000000000affffff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x000000000b000000-0x000000000b01ffff] reserved
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x000000000b020000-0x00000000db6effff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000db6f0000-0x00000000db869fff] reserved
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000db86a000-0x00000000db9f7fff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000db9f8000-0x00000000dbe3efff] ACPI NVS
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000dbe3f000-0x00000000dcf06fff] reserved
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000dcf07000-0x00000000dcfa7fff] type 20
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000dcfa8000-0x00000000deffffff] usable
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000df000000-0x00000000dfffffff] reserved
Dec 22 01:52:20 MyComp kernel: [ 0.000000] BIOS-e820: [mem 0x00000000f8000000-0x00000000fbffffff] reserved
Весь вывод приводить не имеет смысла так как важно узнать что было до перезагрузки, т.е. до [ 0.000000] а начиная с [ 0.000000] уже пошла загрузка системы, итого как я вижу события до перезагрузки:
Dec 20 19:08:26 MyComp clock-applet[2071]: Negative content width -7 (allocation 1, extents 4x4) while allocating gadget (node button, owner GtkToggleButton)
Dec 20 19:08:51 MyComp xdg-desktop-por[1842]: Failed to get application states: GDBus.Error:org.freedesktop.portal.Error.Failed: Could not get window list
Dec 20 19:18:12 MyComp rsyslogd: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="879" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
Dec 21 00:00:48 MyComp kernel: [17586.682274] audit: type=1400 audit(1671570048.775:24): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=5195 comm="cupsd" capability=12 capname="net_admin"
Dec 21 00:01:28 MyComp kernel: [17626.745012] audit: type=1400 audit(1671570088.835:25): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=5197 comm="cups-browsed" capability=23 capname="sys_nice"
Dec 21 05:28:43 MyComp kernel: [37261.703147] [drm] fb mappable at 0xE1200000
Dec 21 05:28:43 MyComp kernel: [37261.703150] [drm] vram apper at 0xE0000000
Dec 21 05:28:43 MyComp kernel: [37261.703151] [drm] size 8294400
Dec 21 05:28:43 MyComp kernel: [37261.703153] [drm] fb depth is 24
Dec 21 05:28:43 MyComp kernel: [37261.703153] [drm] pitch is 7680
Dec 21 05:28:43 MyComp kernel: [37261.703277] fbcon: amdgpudrmfb (fb0) is primary device
Dec 21 05:28:43 MyComp kernel: [37261.703387] Console: switching to colour frame buffer device 240x67
Dec 21 05:28:43 MyComp kernel: [37261.703395] amdgpu 0000:2e:00.0: [drm] fb0: amdgpudrmfb frame buffer device
Dec 21 05:37:40 MyComp kernel: [37798.835299] SUPR0GipMap: fGetGipCpu=0x2b
Dec 21 05:37:47 MyComp kernel: [37805.027221] vboxdrv: 00000000fc07f41e VMMR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.362367] vboxdrv: 0000000068fdb87d VBoxDDR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.499046] VBoxNetFlt: attached to 'enp41s0' / 30:9c:23:62:5e:a1
Dec 21 05:37:47 MyComp kernel: [37805.516529] vboxdrv: 00000000b19f47ca VBoxEhciR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.518098] VMMR0InitVM: eflags=246 fKernelFeatures=0x0 (SUPKERNELFEATURES_SMAP=0)
Dec 21 05:37:47 MyComp kernel: [37805.606669] device enp41s0 entered promiscuous mode
Dec 22 00:00:49 MyComp kernel: [103987.002807] audit: type=1400 audit(1671656449.098:26): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=19437 comm="cupsd" capability=12 capname="net_admin"
Dec 22 00:01:29 MyComp kernel: [104027.089147] audit: type=1400 audit(1671656489.186:27): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=19439 comm="cups-browsed" capability=23 capname="sys_nice"
также смотрю и /var/log/kern.log, ессно и интересны только события до [ 0.000000] :
$ sudo cat /var/log/kern.log
Dec 21 00:00:48 MyComp kernel: [17586.682274] audit: type=1400 audit(1671570048.775:24): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=5195 comm="cupsd" capability=12 capname="net_admin"
Dec 21 00:01:28 MyComp kernel: [17626.745012] audit: type=1400 audit(1671570088.835:25): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=5197 comm="cups-browsed" capability=23 capname="sys_nice"
Dec 21 05:28:43 MyComp kernel: [37261.703147] [drm] fb mappable at 0xE1200000
Dec 21 05:28:43 MyComp kernel: [37261.703150] [drm] vram apper at 0xE0000000
Dec 21 05:28:43 MyComp kernel: [37261.703151] [drm] size 8294400
Dec 21 05:28:43 MyComp kernel: [37261.703153] [drm] fb depth is 24
Dec 21 05:28:43 MyComp kernel: [37261.703153] [drm] pitch is 7680
Dec 21 05:28:43 MyComp kernel: [37261.703277] fbcon: amdgpudrmfb (fb0) is primary device
Dec 21 05:28:43 MyComp kernel: [37261.703387] Console: switching to colour frame buffer device 240x67
Dec 21 05:28:43 MyComp kernel: [37261.703395] amdgpu 0000:2e:00.0: [drm] fb0: amdgpudrmfb frame buffer device
Dec 21 05:37:40 MyComp kernel: [37798.835299] SUPR0GipMap: fGetGipCpu=0x2b
Dec 21 05:37:47 MyComp kernel: [37805.027221] vboxdrv: 00000000fc07f41e VMMR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.362367] vboxdrv: 0000000068fdb87d VBoxDDR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.499046] VBoxNetFlt: attached to 'enp41s0' / 30:9c:23:62:5e:a1
Dec 21 05:37:47 MyComp kernel: [37805.516529] vboxdrv: 00000000b19f47ca VBoxEhciR0.r0
Dec 21 05:37:47 MyComp kernel: [37805.518098] VMMR0InitVM: eflags=246 fKernelFeatures=0x0 (SUPKERNELFEATURES_SMAP=0)
Dec 21 05:37:47 MyComp kernel: [37805.606669] device enp41s0 entered promiscuous mode
Dec 22 00:00:49 MyComp kernel: [103987.002807] audit: type=1400 audit(1671656449.098:26): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=19437 comm="cupsd" capability=12 capname="net_admin"
Dec 22 00:01:29 MyComp kernel: [104027.089147] audit: type=1400 audit(1671656489.186:27): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=19439 comm="cups-browsed" capability=23 capname="sys_nice"
Dec 22 01:52:20 MyComp kernel: [ 0.000000] Linux version 5.10.0-18-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP Debian 5.10.140-1 (2022-09-02)