/var/log/messages question

[Phil Meyer]

On 05/31/2011 08:25 AM, R. G. Newbury wrote:
>> On Mon, 2011-05-30 at 18:36 -0400, Tom Horsley wrote:
>>>>   Just for curiosity, why has no one ever arranged to
>>>>   log something like "Hey! I'm booting the system again!"
>>>>   as the very first line in that goes to /var/log/messages
>>>>   when the system is booting?

It does.
There are several ways to find the top of the last boot.
Assuming that you have rebooted since the last time /var/log/messages 
was rolled over, you can easily search for the top of the messages.

Here are a couple of guidelines:

First, the word ' Linux ', note the spaces, is not common in the logs, 
and always appears near the top of the boot sequence.  Usually within 
the first 4 or 5 lines.

Second, no matter how fast your system reboots, the messages written at 
boot time will be written in a faster sequence than what was happening 
before the reboot, thus giving an obvious 'break' in the log time stamps 
at the beginning of a boot.

If you check more than a few times, you will notice that syslog itself 
reports the first line of boot, and you can search for that.

So in summary, if you see a syslog startup, followed within a few lines 
by the word ' Linux ', and what comes after that appear to be BIOS info, 
and that all these messages happen in the same second or two, you have 
found the top of the boot sequence.

Here is the top of my last boot:

...
May 30 08:11:27 grok kernel: imklog 5.7.9, log source = /proc/kmsg started.
May 30 08:11:27 grok rsyslogd: [origin software="rsyslogd" 
swVersion="5.7.9" x-pid="802" x-info="http://www.rsyslog.com"] start
May 30 08:11:27 grok kernel: [    0.000000] Initializing cgroup subsys 
cpuset
May 30 08:11:27 grok kernel: [    0.000000] Initializing cgroup subsys cpu
May 30 08:11:27 grok kernel: [    0.000000] Linux version 
2.6.38.6-27.fc15.x86_64 (mockbuild at x86-03.phx2.fedoraproject.org) (gcc 
version 4.6.0 20110428 (Red Hat 4.6.0-6) (GCC) ) #1 SMP Sun May 15 
17:23:28 UTC 2011
...

Good Luck!