Sometimes when my headless Pi Zero W hangs or goes offline without coming back, I hard reset it by disconnecting the power cable and reconnecting it.

I'm trying to look for clues in /var/log/syslog to find out what it was doing when I pulled the plug, but I don't know what markers I should look for to find the point where the power plug was pulled and then reconnected.

Is there a way that I can have a marker (eg. a row of asterixes) logged at the earliest point after cable is connected? Is there something already in a logfile that might indicate this?

Pi Zero W, Raspian Stretch 4.14.98+

  • is the date/time not good enough? Mar 15 '19 at 9:49
  • I found this in my logs as the first entry in the boot process: kernel: [ 0.000000] Booting Linux on physical CPU 0x0
    – jake
    Mar 15 '19 at 10:37
  • @JaromandaX the pi doesn't have a real time clock, so there's no gap in the log timestamps until the ntp daemon updates the date.
    – John Haire
    Mar 18 '19 at 0:19
  • @jake I've seen that line, but I think there's a bit more in the logs from the kernel before that - related to loading the storage devices and mounting filesystems. The problem is that without a realtime clock, the next boot appears to happen at the same time as whatever happened before that.
    – John Haire
    Mar 18 '19 at 0:25

If you want to get logging started from the last boot you can use journalctl. By default it will only log events from the last boot. Also it has an option --boot that specifies from what boot you want to see messages. For example --boot=-1 will show you messages from last but one boot up. But as already said, persistent journaling isn't enabled by default so using a boot ID has no effect. So for the current boot messages just run:

rpi ~$ journalctl --boot

If you want to look backwards on older boot logging you can enable persistent logging with:

rpi ~$ sudo mkdir -p /var/log/journal
rpi ~$ sudo systemd-tmpfiles --create --prefix /var/log/journal

Be aware that this will occupy additional space on your SD Card. But then you are also able to look at the shutdown messages at the last but one boot up.


Use the uptime command.

If you want the boot time use uptime -s

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.