18

Last shows "crash" at 12:02 and 14:18, but the system didn't stop working at that time. The reboot at 15:03, on the other hand, was to recover from an actual crash - our system stopped responding at 14:46. Why does last show two "crashes" prior to the actual crash of the machine? 

[admin@devbox log]$ last | head
myuser pts/2        myhostname  Wed Sep 28 15:12   still logged in
myuser pts/2        myhostname  Wed Sep 28 15:09 - 15:12  (00:02)
myuser pts/2        myhostname  Wed Sep 28 15:07 - 15:09  (00:01)
myuser pts/1        myhostname  Wed Sep 28 15:06   still logged in
myuser pts/0        myhostname  Wed Sep 28 15:04   still logged in
reboot   system boot  2.6.18-274.el5PA Wed Sep 28 15:03          (00:09)
myuser pts/1        myhostname  Wed Sep 28 14:18 - crash  (00:44)
myuser pts/0        myhostname  Wed Sep 28 12:02 - crash  (03:01)

EDIT: The reboot at 15:03 is real enough - but the two "crash" entries at 14:18 and 12:02 I can't explain.

Kyle
  • 333
  • 1
  • 3
  • 11
  • 40 minutes ... but that's since the reboot. – Kyle Sep 28 '11 at 19:44
  • Ah, sorry. Didn't understand your question. When you said "but the system didn't reboot", I thought you were saying that no reboot happened at all. – Mat Sep 28 '11 at 19:52

1 Answers1

20

last prints crash as the logout time when there is no logout entry in the wtmp database for a user session.

The last entry in last output means that myuser logged in on pts/0 at 12:02 and, when the system crashed between 14:18 and 15:03, that user should be still logged in.

Usually, in wtmp there are two entries for each user session. One for the login time and one for the logout time. When a system crashes, the second entry could be missing. So last supposes that the user was still logged on when the system crashed and prints crash as the logout time.

To be clearer, that two "crash" lines are only the two session that were active when the system crashed around 15:00, not two system crashes.

Matthias Braun
  • 7,797
  • 7
  • 45
  • 54
andcoz
  • 16,830
  • 3
  • 38
  • 45
  • Don't I feel rusty now... sure I knew this at some point! Thanks... – Kyle Sep 28 '11 at 21:47
  • Does `last` always print a reboot record after a crash? And is it possible for the user session to crash but the entire OS? – CMCDragonkai Dec 08 '15 at 11:38
  • 1) Yes, it is. `wtmp` will record each system boot but the message displayed (by `last`) is implementation dependent. 2) No, user session cannot _crash_. A program managing a user session can _abnormally end_ but, in this case, `wtmp` will simply record a _logout_. – andcoz Dec 08 '15 at 18:42