10

While some output was being written to my terminal, a wall message passed by. It went too fast for me to read it. All I could tell was

Broadcast message from

The system is going down for

And even most of that is an educated guess.

Crucially, I missed when it's going down. 20 minutes? 2 hours? 24 hours?

Can I either reread the wall message, or look for planned shutdowns/reboots somewhere? I'm just an ordinary user without root.

gerrit
  • 3,457
  • 6
  • 25
  • 41
  • some quick checking (centos7) shows /var/log/messages has a record that the user sent a wall message, but not the contents of said message. i'm not sure 'wall' or 'write' actually logs the contents of messages anywhere... – 0xSheepdog Jul 11 '17 at 17:26
  • Even if wall doesn't, perhaps shutdown/reboot has a publicly accessible log of planned shutdowns? I'm 99% sure it was a shutdown-message; I just want to know when. In any case, I don't have read permissions for `/var/log/messages`. – gerrit Jul 11 '17 at 17:27
  • okay, I executed a `shutdown -r` (with the +1 minute implied) and got standard system shutdown/reboot wall message. there were entries recorded in `/var/log/messages` which doesn't help you if you can't read it as a user. =( from the man page, _If the time argument is used, 5 minutes before the system goes down the /run/nologin file is created to ensure that further logins shall not be allowed._ You could look for the presence of /run/nologin which would give a clue as to the intent and timing of shutdown. Not overly helpful I know... – 0xSheepdog Jul 11 '17 at 17:34
  • I don't have a `/run`. I do have `/var/run` which has no `nologin`, which might suggest I have at least 5 more minutes, which is reassuring ;-) – gerrit Jul 11 '17 at 17:38
  • 2
    `nologin` will only exist in the five minutes before shutdown, so it's not terribly helpful if the sysadmin has used `shutdown` to schedule a system halt or reboot in three weeks. However, there will be further periodic notices with increasing frequency as the shutdown horizon nears. The manual pages for `shutdown`, `wall`, and `mesg` do not indicate that the contents of such messages are preserved anywhere. The presence of `/var/run/nologin` tells you that you have at _most_ five minutes remaining. – DopeGhoti Jul 11 '17 at 17:38
  • Ah, it just came again and this time I caught it: `The system is going down for halt in 780 minutes!`. Question still stands though :) – gerrit Jul 11 '17 at 18:02
  • @gerrit Well as you saw, the message will repeat itself multiple times - and more frequently as the time of shutdown draws near... (Of course, that is little comfort if sysadm decides to shutdown the system (almost) immediately). If it's scheduled maintenance, then there may also been sent email. There may also be information /etc/motd (MessageOfTheDay) - this is the message that's shown when you log-in, and/or in /etc/issue - the pre-login information text. You can look at these files after you've logged-in too (with cat or less) (if they exists). – Baard Kopperud Jul 11 '17 at 18:19
  • Someone did "shutdown -h 800", check your email (etc), there might be an explanation there – Jasen Aug 21 '17 at 11:08
  • as it's for "halt" and not "reboot" I expect some physical maintenance is intended, perhaps untangling the power cord, or something more involved. – Jasen Aug 21 '17 at 11:10
  • can't scroll your terminal back to see the message? I always login to every system with screen(1) running so I get searchable (& cutnpasteable!) scrollback, always, for such reasons. – math Sep 14 '17 at 14:04
  • @math I use tmux for that, but the wall message does not get sent to the tmux (or screen) terminal; it gets sent to the underlying login terminal. – gerrit Sep 25 '17 at 14:49
  • Just tested in screen - makes a nice mess of what Im doing in my screens :) Every screen got the `wall(1)` msg. – math Sep 26 '17 at 15:49
  • Formally people used [xconsole](https://www.x.org/archive/X11R6.8.2/doc/xconsole.1.html) for that. – ceving Oct 16 '17 at 20:22
  • @ceving When logged in to a remote machine? Do you mean X forwarding took care of forwarding those messages? – gerrit Oct 16 '17 at 20:40
  • 1
    @gerrit If you start xconsole on a remote host, it runs on the remote host. If it opens a file, it is a file on the remote host. This means xconsole reads /dev/console on the remote host. Your local X server shows just the output and makes sure that your local keyboard and mouse events are send to xconsole running on the remote host. – ceving Oct 17 '17 at 07:44
  • @ceving Right. Unfortunately, it looks like the remote host does not have `xconsole`. – gerrit Oct 17 '17 at 10:21
  • 1
    If there's a impending shutdown running, then (to write it again) there's a shutdown process running, in order to wait and send regular broadcasts before initiating the real shutdown. If the system settings allow a normal user to see all process, just do a `ps -ef|grep -w shutdown` and you should see the shutdown process, with its arguments, including the time parameter (which could be absolute or relative) – A.B Nov 03 '17 at 17:32

1 Answers1

2

If you have X forwarding and the ability to install (or compile) your own programs, try running xwrited to turn wall messages into desktop notifications.

If your UNIX box is running a traditional init (System V or BSD), you can look for the shutdown process using ps:

ps aux | grep shutdown

However, when running systemd, the timer is implemented in the logind.service, so ps won't help. You may be able to find out if there is a shutdown scheduled by looking in the file /run/systemd/shutdown/scheduled:

$ cat /run/systemd/shutdown/scheduled 
USEC=1511457755542032
WARN_WALL=1
MODE=poweroff
WALL_MESSAGE=System going down for scheduled maintenance

To convert from microseconds to a reasonable date, you can use gawk:

$ awk -F= '/USEC/ {print strftime("%c", $2/1E6)}' < /var/run/systemd/shutdown/scheduled
Thu 23 Nov 2017 10:03:21 AM CET

However, note that some versions of systemd do not delete the file when a shutdown is canceled. (The version I tried, 232, leaves the file hanging around after shutdown -c).

hackerb9
  • 1,418
  • 13
  • 20