8

When I issue the command last in my terminal I see the following entries i.e. "crash":

i meant the command last " show listing of last logged in users".

root@lab18:~# last
tito     pts/3        x.x.x.x   Tue Nov 13 16:22   still logged in
tito     pts/3        x.x.x.x   Tue Nov 13 09:13 - 16:22  (07:09)
reboot   system boot  3.2.0-32-generic Mon Nov 12 23:58 - 16:22  (16:24)
tito     pts/1        192.168.26.5     Mon Nov 12 23:56 - crash  (00:01)
tito     pts/4        192.168.26.5     Mon Nov 12 22:46 - crash  (01:12)


uname -a
Linux HomeServer 3.2.0-32-generic-pae #51-Ubuntu SMP Wed Sep 26 21:54:23 UTC 2012 i686 i686 i386 GNU/Linux
last reboot
reboot   system boot  3.2.0-32-generic Mon Nov 12 23:58 - 16:29  (16:31)
wtmp begins Thu Nov  1 10:17:16 2012

I have found some information about the crash in the syslog and the kernel.log However i was curious if various linux distributions (ubuntu) is writing some other files other than the syslog or kernel.log where specific information about the crash can be decoded. And what I mean is for example many networking vendors do i.e. cisco, hp, juniper, enterasys do have syslog, current.log files, SNMP informs/traps messages, that are saved to some sort of place locally on the file system or remotely in case an even occur, however they also have specifically designed files such as systemDumps where a backtrace from the callstack can be found and analyzed in case a crash occur and occasionally this could help to debug the problem. So the question is does Ubuntu has also such kind of place where information is being stored about the crash.

Regards,

Tito

Tito
  • 181
  • 1
  • 6

1 Answers1

3

It is not really clear where these lines come from, what has crashed, etc. What 'last' command are you running? As far as I know, the last command you would normally run is this one: show listing of last logged in users (from its man-page).

Are you checking last reboot ? If so and this means your system crashed before a reboot, you can start by checking out the system logs:

less /var/log/syslog

or, if that is too new

less /var/log/syslog.1

If you need an older entry they are most likely gzipped, zo use

zcat /var/log/syslog.2.gz

In some versions (server install) you might need special permissions to read these files, so if you get a

/var/log/syslog: Permission denied

error you need to prepend your commands with sudo

sudo less /var/log/syslog
Nanne
  • 8,685