When I issue the command last in my terminal I see the following entries i.e. "crash":

i meant the command last " show listing of last logged in users".

root@lab18:~# last
tito     pts/3        x.x.x.x   Tue Nov 13 16:22   still logged in
tito     pts/3        x.x.x.x   Tue Nov 13 09:13 - 16:22  (07:09)
reboot   system boot  3.2.0-32-generic Mon Nov 12 23:58 - 16:22  (16:24)
tito     pts/1     Mon Nov 12 23:56 - crash  (00:01)
tito     pts/4     Mon Nov 12 22:46 - crash  (01:12)

uname -a
Linux HomeServer 3.2.0-32-generic-pae #51-Ubuntu SMP Wed Sep 26 21:54:23 UTC 2012 i686 i686 i386 GNU/Linux
last reboot
reboot   system boot  3.2.0-32-generic Mon Nov 12 23:58 - 16:29  (16:31)
wtmp begins Thu Nov  1 10:17:16 2012

I have found some information about the crash in the syslog and the kernel.log However i was curious if various linux distributions (ubuntu) is writing some other files other than the syslog or kernel.log where specific information about the crash can be decoded. And what I mean is for example many networking vendors do i.e. cisco, hp, juniper, enterasys do have syslog, current.log files, SNMP informs/traps messages, that are saved to some sort of place locally on the file system or remotely in case an even occur, however they also have specifically designed files such as systemDumps where a backtrace from the callstack can be found and analyzed in case a crash occur and occasionally this could help to debug the problem. So the question is does Ubuntu has also such kind of place where information is being stored about the crash.




It is not really clear where these lines come from, what has crashed, etc. What 'last' command are you running? As far as I know, the last command you would normally run is this one: show listing of last logged in users (from its man-page).

Are you checking last reboot ? If so and this means your system crashed before a reboot, you can start by checking out the system logs:

less /var/log/syslog

or, if that is too new

less /var/log/syslog.1

If you need an older entry they are most likely gzipped, zo use

zcat /var/log/syslog.2.gz

In some versions (server install) you might need special permissions to read these files, so if you get a

/var/log/syslog: Permission denied

error you need to prepend your commands with sudo

sudo less /var/log/syslog
| improve this answer | |
  • @Mik : I believe you are incorrect in your edit: on my system we have this -rw-r----- 1 syslog adm 16K Nov 13 11:30 syslog and my user does need to use sudo to read it. – Nanne Nov 13 '12 at 10:32
  • On my Ubuntu 12.04 LTS sudo is not needed and it isn't normally needed at least for desktop systems. – user76204 Nov 13 '12 at 10:33
  • There wasn't a mention of which version and seeing that there are versions that require this (and there is as far as I know no issue in using an extra 'sudo' command), it seems to me that leaving the sudo in place is the best option? (btw, I wasn't planning on an edit-war, we could meet in the middle and just add this conversation in the answer?) – Nanne Nov 13 '12 at 10:35
  • Yes, you can put a note about it in the answer. – user76204 Nov 13 '12 at 10:37
  • Hello sorry for the misunderstanding i have edited the question and made it more detailed. – Tito Nov 13 '12 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.