Detecting Improper Shutdown in Linux

[idgaf13]

I was wondering if there was a way to detect improper shutdown on linux..
I want to print out the /var/log/messages file when kernel oops or kernel panic or improper shutdown occurs.

any help will be appreciated.
thanks

 

[Nothinman]

'last' should tell you. I'm not sure if there's a more official or reliable way.

I just happened to have a few power flickers recently...

$last | grep crash
root tty1 Fri Jun 13 01:48 - crash (00:11)
username pts/2 host.blah.com Wed Jun 11 23:21 - crash (20:24)
username pts/3 host.blah.com Wed Jun 11 23:21 - crash (20:24)

 

[drag]

Not exactly sure how to do it, it would take some time to figure out the details, but here is a idea...

When you OS boots up it should automaticly run a test on the filesystem to determine if it was shutdown properly, if it detects a anomily it will run thru the fix it program. (fsck.whatever) You could use the information returned by fsck to run a quick bash script to make a copy of the message

Here is a clue, a snippet from man fsck:

The exit code returned by fsck is the sum of the following conditions:
0 - No errors
1 - File system errors corrected
2 - System should be rebooted
4 - File system errors left uncorrected
8 - Operational error
16 - Usage or syntax error
32 - Fsck canceled by user request
128 - Shared library error
The exit code returned when multiple file systems are checked is the
bit-wise OR of the exit codes for each file system that is checked.

So once you make the script add it to your fsck startup script and that should do it. Put a simple echo command in it to make sure the changes work.

Of course there are 400,000 different ways to do this, but this is just a suggestion. It may only do these codes on ext2/3 file systems, others may be different too.

 

[Nothinman]

if it detects a anomily it will run thru the fix it program. (fsck.whatever) You could use the information returned by fsck to run a quick bash script to make a copy of the message

Journaling filesystems never get fsck'd. fsck.xfs just return's 0 every time because the replay of the journal will take care of the ungracefull shutdown, if it's broken beyond that you need xfs_repair.

fsck.xfs(8) fsck.xfs(8)

NAME
fsck.xfs - do nothing, successfully

 

[drag]

Well, how about this. During the shutdown script make a file in the /var folder called shutdown.detect

like this:

echo 0 > /var/log/shutdown.detect

then a start up script that checks this file and make sure that there is a 0 in the file, if it checks out OK, then it does
echo 1 > /var/log/shutdown.detect

If it detects a 1 in that file then it knows it didn't go thru the shutdown script and then it does the logging stuff.

Is that better?

 

[Nothinman]

Not really, improper shutdown means anything can happen to the filesystem including the deletion or null'ing of your file. XFS has a habit of writing zeros to files if they have dirty buffers and an improper unmount happens.

 

[drag]

So, your telling me that if the start up script detects a zero in that file it could be that the xfs, or whatever, filing system could of filled that file up with zero's? Even if the file is only touched once doing the last start-up inorder to make it a 1 and never touched again until the next shutdown or startup?

I think that if that file system is that far gone that a dirty buffer would overright a part of the /var directory wouldn't it be plenty obvious that your computer shutdown inproperly the last time.

I was thinking he wanted to keep a record of improper shutdowns just becuase he may leave the computer unattended for longs periods were power interuptions may occure, or some such thing and by the time he gets back the computer would have already rebooted and it would look like nothing happened at all.

 

[Nothinman]

So, your telling me that if the start up script detects a zero in that file it could be that the xfs, or whatever, filing system could of filled that file up with zero's?

I think technically it's filled with NULLs (ascii 0s).

Even if the file is only touched once doing the last start-up inorder to make it a 1 and never touched again until the next shutdown or startup?

That I can't really say either way.

Why not do something simple? Have it email the logs on every reboot? If he's expecting them he can just delete them, if not he's got them in an inbox waiting for him. And anyway, an oops or panic normally won't reboot the box, if anything it'll probably hang and need power cycled.

 

[drag]

hehe, I thought it was pretty simple. Do the e-mail thing only if there is a 1 in that file... or a zero if that will work around the dirty buffer problem. Just kinda cut down on the spam, that's all. 🙂

 

[Nothinman]

Well if he's expecting the mail after a manual reboot, it's not really spam =)