Linux: How to verify unexpected system restarts

In Linux, you can verify system restarts and view reboot history using various commands and log files. Here are some methods to check and verify system restarts:

  1. Using the last Command:The last command displays a list of system login entries and system shutdown/reboot times. To view reboot history, run:
    • last reboot The output will show a list of system reboot times, who initiated the reboot, and from which terminal or IP address it occurred.
  2. Checking System Logs:System logs contain information about system events, including reboots. The /var/log/messages or /var/log/syslog file typically contains reboot information. You can use grep to filter the relevant entries:
    • grep 'reboot' /var/log/messages orbashCopy codegrep 'reboot' /var/log/syslog This will display lines indicating system reboots along with timestamps.
  3. Using the uptime Command:The uptime command provides information about system uptime, including the current time, how long the system has been up, and the number of logged-in users. The load average values can also give you an idea if the system recently restarted:
    • uptime If the system uptime is low, it suggests a recent restart.
  4. Checking the /var/log/wtmp File:The /var/log/wtmp file contains a record of all logins and logouts, including system reboots. You can use the last command with the -f option to view this file:
    • last -f /var/log/wtmp This will display a more detailed history of logins, logouts, and reboots.
  5. Using Audit Logs (if configured):If you have the auditd service configured and running, it may log system events, including reboots, in /var/log/audit/audit.log. You can use the ausearch and aureport commands to search for and report on reboot events in the audit log.

These methods should help you verify system restarts and identify when and why they occurred. The choice of method may depend on your specific needs and the availability of logs on your system.

UNIX-Linux: How to identify what type of Unix or Linux System we are using

To identify the type of Unix or Linux system we are using run:

$ uname -a

Linux Example:

[root@redhat9-01 ~]# uname -a
Linux redhat9-01 5.14.0-284.30.1.el9_2.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 25 09:13:12 EDT 2023 x86_64 x86_64 x86_64 GNU/Linux
[root@redhat9-01 ~]#

AIX Example:

# uname -a

AIX crnimx01 1 7 000482ADD600

#

Linux: Verify file system utilization

To verify file system utilization on Linux, you can use several commands and tools that provide information about disk space usage, including the df and du commands. Here’s how to use each of these commands:

  1. df – Disk Free Space:The df command is a simple and commonly used tool to display information about file system disk space utilization. By default, it shows information about mounted file systems.To display file system utilization information for all mounted partitions, run:
    • df -h The -h option makes the output more human-readable, showing sizes in megabytes (MB) or gigabytes (GB) instead of blocks.
  2. du – Disk Usage:The du command is used to estimate file and directory space usage. It’s helpful for drilling down into specific directories to see which files or directories are consuming the most space.To check the disk usage of a specific directory, navigate to that directory and run:bashCopy codedu -h The -h option, as before, makes the output human-readable.If you want to see the disk usage of the current directory and its subdirectories in a summarized form, you can use the following command:bash
    • du -sh * This will display the sizes of the subdirectories and files in the current directory.

These commands will help you verify file system utilization on your Linux system and identify which directories or file systems are consuming the most disk space. Depending on your needs, you can choose the most suitable command for your analysis.