3

Does the Pi keep a log of its restarts? I found a good record of "Booting ..." in /var/log/messages in one of my Pi's, but in another Pi, /var/log/messages shows only rsyslogd entries. Both Pi's are Pi 3 Model B and both are running Raspbian GNU/Linux 8 (jessie). Is there a way to increase the amount of detail logged to messages? Or is there another log that saves the date & time of restarts?

(My Pi's are running fine and I'm hoping a record of restarts or "Booting ..." can tell me when there were power outages)

3 Answers 3

4

last shows a listing of last logged in users.

last -x should show what you want, although not directly.

last -x shows "the system shutdown entries and run level changes"

pi       pts/0        10.1.2.100       Mon Jan 11 17:32   still logged in
pi       pts/0        10.1.2.100       Sat Jan  9 18:06 - 13:08 (1+19:01)
pi       pts/0        fe80::1ca4:d038: Fri Jan  8 21:31 - 15:37  (18:06)
runlevel (to lvl 5)   5.4.83-v7l+      Fri Jan  8 21:31   still running
pi       tty1                          Fri Jan  8 21:30   still logged in
pi       tty7         :0               Fri Jan  8 21:30   still logged in
reboot   system boot  5.4.83-v7l+      Thu Jan  1 10:00   still running
shutdown system down  5.4.79-v7l+      Fri Jan  8 21:30 - 10:00 (-18635+10:30)
pi       pts/0        10.1.2.100       Wed Jan  6 17:28 - 21:28 (2+04:00)
pi       pts/0        fe80::1ca4:d038: Tue Jan  5 17:36 - 14:29  (20:52)
pi       pts/0        10.1.2.100       Tue Jan  5 10:06 - 12:22  (02:16)
pi       tty7         :0               Mon Jan  4 16:29 - 21:28 (4+04:59)
pi       tty1                          Mon Jan  4 16:29 - down  (4+05:01)
runlevel (to lvl 5)   5.4.79-v7l+      Mon Jan  4 16:29 - 21:30 (4+05:01)
reboot   system boot  5.4.79-v7l+      Thu Jan  1 10:00 - 21:30 (18635+10:30)

EDIT

If you are happy with the limited reporting in messages the following script will show boots. This only shows recent attempts (default 4 weeks). I had a similar script working on kern.log but adapted this to /var/log/messages although the results are similar.

#!/bin/bash
#Print login history
for logf in $(ls /var/log/messages*.gz | sort -rV) ; do zcat $logf | grep -E "Booting" ; done
# Include most recent
for logf in $(ls /var/log/messages* | sort -rV) ; do cat $logf | grep -E "Booting" ; done

On my Pi this shows:-

Dec 14 16:11:24 MilliwaysPi4 kernel: [    0.000000] Booting Linux on physical CPU 0x0
Dec 19 11:36:37 MilliwaysPi4 kernel: [    0.000000] Booting Linux on physical CPU 0x0
Dec 19 12:53:25 MilliwaysPi4 kernel: [    0.000000] Booting Linux on physical CPU 0x0
Dec 21 15:00:57 MilliwaysPi4 kernel: [    0.000000] Booting Linux on physical CPU 0x0
Jan  4 16:28:36 MilliwaysPi4 kernel: [    0.000000] Booting Linux on physical CPU 0x0
Jan  8 21:30:25 MilliwaysPi4 kernel: [    0.000000] Booting Linux on physical CPU 0x0
2

The systemd journal is only transient stored in a /run/log/journal/ which is located in RAM and lost on every reboot. You can make its storage persistent on the SD Card so you can also query old boots. In /usr/share/doc/systemd/README.Debian you will find:

To enable persistent logging, create /var/log/journal:

mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal

systemd will make the journal files owned by the "systemd-journal" group and add an ACL for read permissions for users in the "adm" group. To grant a user read access to the system journal, add them to one of the two groups. This will allow you to look at previous boot logs with e. g.

journalctl -b -1

If you enable persistent logging, consider uninstalling rsyslog or any other system-log-daemon, to avoid logging everything twice.

2
  • system.journal seem to be binary. How do you read the contents to query old boots? Jan 16, 2021 at 1:56
  • @user3217032 Look at my answer. The example shows the boot (-b) before the current boot (-1).
    – Ingo
    Jan 16, 2021 at 10:46
0

Thanks above for info on dmesg and last commands. But what I found worked best was viewing var/log/messages and searching for the keyword "Booting": less /var/log/messages | grep Booting and less /var/log/messages.1 | grep Booting. For older archived messages, e.g., messages.2.gz, zcat /var/log/messages.2.gz | grep Booting worked nicely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.