Recovering forensic data from a failed boot
Joe Zeff
joe at zeff.us
Sat Jan 7 22:02:15 UTC 2012
As I may have mentioned before, my laptop runs F16 but will only boot
properly from my last F14 kernel. All attempts to boot from a 3.X
kernel fail before gdm starts. Are there any logs that survive after I
reboot into the old 2.X kernel so that I can see just what's happening?
I presume that some of the data will be in /var/log/messages, but is
there anything else? Is there a way to be sure that a copy of boot.log
is kept, or if it already is, where is it? So far, just reporting on
the error messages I see on the screen hasn't led to any suggestions how
to correct whatever's wrong, so I'm hoping there's a way to get more data.
More information about the users
mailing list