On 6/9/23 06:12, Jon Tibble via illumos-discuss wrote:
There is however some weird logging in last where it appears as if the
system went down, or was told to go down, hours before it happened.
Entries like:
reboot system boot Thu Jun 8 00:22
reboot system down Wed Jun 7 15:49
and
reboot system boot Sat May 27 23:58
reboot system down Fri May 26 13:30
Both these reboots actually occurred a minute or so before the system
boot timestamp so the reboots only took a minute and there was no
end-user impact at that time of night.
The "system down" message is logged by svc.startd at boot time based on
the later of the atime or mtime on /var/adm/wtmpx; see the block comment
in utmpx_write_boottime() in usr/src/cmd/svc/startd/utmpx.c :
/*
* The DOWN_TIME record tracks when the OS became unavailable
* during the previous boot. We stat(2) WTMPX and check its
* attributes to determine when (and how) the OS became
* unavailable. If the file is empty, skip writing a DOWN_TIME
* record. Otherwise, check the access and modify times and
* use whichever is latest as the time that the OS became
* unavailable. If st_atime is latest, the instance crashed or
* the machine lost power. If st_mtime is latest, the shutdown
* was controlled.
*/
Note that this assumes that the filesystem containing /var/adm/wtmpx is
not mounted noatime.
If the system was rebooted in a way that didn't update /var/adm/wtmpx
before shutdown, and noatime is set on /var, a stale "system down" time
is expected.
------------------------------------------
illumos: illumos-discuss
Permalink:
https://illumos.topicbox.com/groups/discuss/T9b0e3a6300508f9b-M6d08b3ceda992c09f3a3e15a
Delivery options: https://illumos.topicbox.com/groups/discuss/subscription
