List of dates when FreeBSD was started/shut down

MichaelF

MichaelF

Hello!

I know that I can issue the sysctl.kernboottime command to find out when the OS was started but I don not know how can I get a list of all OS starts - in Windows I can do it by filtering System log by 6009 event, can I get the same information in FreeBSD?

Q2: The same applies to OS shutdowns - is there a way to get a list of all (or during some period of time) OS shutdowns?

Thank you in advance,
Michael
 
According to the documentation "last -- indicate last logins of users and ttys" while my goal is to know when the OS was started - NOT the user session (you can turn on the sever but do not login to it). As far as I see the sysctl.kernboottime display exactly this, but I don't know how can I get a list of all/some previous starts.
 
From last(1) :
The pseudo-user reboot logs in at reboots of the system, thus “last
reboot” will give an indication of mean time between reboot.
Click to expand...

You may need to go into older logs, for example:

$ last -f /var/log/utx.log.2 reboot
boot time Sat Mar 25 22:55
shutdown time Sat Mar 25 22:54
boot time Sat Mar 25 22:50
shutdown time Sat Mar 25 22:49
 
Yes, I've seen it but still don't understand

1) "mean time between reboot." - sounds pointless to me as I would expect here somethink like "...mean time between something1 and something2"... just don't understand how there can be ~something "mean" between something singular

2) how should I interpret these values:
boot time Sat Mar 25 22:55
shutdown time Sat Mar 25 22:54

- does it mean that the server was shutdown at 22:54 and then started one minute later at 22:55?
 
Forget what was said about "mean time". That's just a use-case of the data from last(1). The data are the timestamps of shudowns, as long as the system shuts down in an orderly fashion. Nothing well handles power outages nor crashes.
 
Thank you all for your replies!

...am I getting it right that there's no way to get a list of all previous values of the sysctl.kernboottime ?
 
What do you want to achieve? Do you wanna calculate availability metrics? Do you want to know, say in a duel boot environment, how much a user uses FreeBSD vs. a different OS?
  • For ad-hoc inspection I actually use last(1), too.
  • For monitoring I configure snmpd(8) and take an snmpwalk(1).
  • For analysis there are AUE_REBOOT and AUE_SYSTEMBOOT audit(4) events.
 
MichaelF said:
Thank you all for your replies!

...am I getting it right that there's no way to get a list of all previous values of the sysctl.kernboottime ?
Click to expand...

As long as the boot completes, you can see boot times from the last ~ three months (by default, edit /etc/newsyslog.conf to change the number of monthly-rotated logs to keep) via (sh):

for x in /var/log/utx.log*; do last -f "$x" reboot; done | grep boot


As far as all previous values, I'm not aware of a facility set up to store that.
 
You could use prometheus to store time series about some service starting, like having a graph to 1 when the service is up and 0 when it is down.
Then you could check for when the value change to detect shutdown and power on.
 
Thank you all for your help once again!

"What do you want to achieve?" - to have to distinct lists: 1) the time the OS was started (shut down) 2) the time the user session was started.

There's no list of sysctl kern.boottime events but last ...reboot returns the same data (4.png) - thanks for the suggestion!
04.png


By the way, I noticed that when a server is getting into sleep mode by KDE (~ after 15 minutes by default) and then is being awakened some time later the sysctl kern.boottime displays the time of awakening as the boot time while the last command displays the previously logged on users as "still logged in" - in this case the server's boot time is later then the user logon time (00.png).
00.png
 
MichaelF said:
I know that I can issue the sysctl.kernboottime command to find out when the OS was started but I don not know how can I get a list of all OS starts - in Windows I can do it by filtering System log by 6009 event, can I get the same information in FreeBSD?

Q2: The same applies to OS shutdowns - is there a way to get a list of all (or during some period of time) OS shutdowns?
Click to expand...

Here is a startup script I wrote called /usr/local/etc/rc.d/updown. It emails the root user (and assumes useful forwarding) with info about who rebooted / halted / powered off the system, and after a boot reports how long the system took to reboot (or if it was a crash restart). You'll want to strip out the stuff in updown_start() and updown_stop() that does things of interest only to my systems, and also you should review this (and any other executable file) before running it, to make sure it isn't doing Evil Things. Rename from updown.txt to updown, put in /usr/local/etc/rc.d and set updown_enable="YES" in /etc/rc.conf.

You could modify it to append to a file somewhere on the system instead of / in addition to sending email. That way you'll have a permanent record of every shutdown / startup after you install the script.
 

Attachments

  • updown.txt
    3.6 KB · Views: 41
You must log in or register to reply here.
Back
Top