I recently had an extended power outage and wish to get a refund from my electricity provider, who provide a guaranteed service level and will reimburse me for my time with no power.
In order to facilitate this, I need to find out as close as possible to when the power went out. Ideally the last syslog entry would provide this for me.
Unfortunately for some reason my /var/log/syslog.log and /var/log/messages.log are both empty - not even messages from my current boot are there. This is a bit odd because they were full of messages a couple of days ago. The only thing I have done since then is a pacman -Syu, so I'm wondering whether something broke.
So 1) any idea why the log files are now all zero bytes (even the .0 and .1 files are zero bytes, so logrotate is at least working) and 2) any idea how to find the timestamp of the last log message from the previous boot, assuming these haven't been lost when the files were truncated?
Many thanks for any suggestions!
Because archlinux have switched to systemd. You can have system log with journalctl. If you do not have a battery, the system will of course have shut down before any tool can log anything. You can try to find the last modified file or the last accessed file (if you do not mount with the noatime option); just play with the find command.
Thanks for the reply! I don't think I am using systemd because apparently "journalctl" is used to print messages and it does not print anything at all, even "journalctl -a" prints nothing.
Good suggestion about the last modified file timestamps, I'll take a look.
... I don't think I am using systemd ...
It's easy enough to check:
$ cat /proc/1/comm systemd
Plus if you are still using initscripts won't you have noticed things gradually not working as expected, unless you are maintaining them yourself somehow?
All men have stood for freedom...
For freedom is the man that will turn the world upside down.