From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 26F6D1FF130 for ; Mon, 20 Jul 2026 16:58:27 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 2CEE4214CD; Mon, 20 Jul 2026 16:58:26 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Mon, 20 Jul 2026 16:58:20 +0200 Message-Id: Subject: Re: [PATCH manager] report: list recent reboot events and their kernel version From: "Alexander Zeidler" To: "Maximiliano Sandoval" , "Thomas Lamprecht" References: <20260720123649.226360-1-a.zeidler@proxmox.com> <55625334-51ae-45d8-b365-91d85d1cc541@proxmox.com> In-Reply-To: X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784559475794 X-SPAM-LEVEL: Spam detection results: 0 DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 6Q6M6MVWLEHULEVBMDFHQOHDHFW6GPIP X-Message-ID-Hash: 6Q6M6MVWLEHULEVBMDFHQOHDHFW6GPIP X-MailFrom: a.zeidler@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: pve-devel@lists.proxmox.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon Jul 20, 2026 at 3:33 PM CEST, Maximiliano Sandoval wrote: > Thomas Lamprecht writes: > >> Am 20.07.26 um 14:38 schrieb Alexander Zeidler: >>> Based on the most recent reboot events, it is possible to determine >>> whether and when a crash, fencing, or reboot occurred and with which >>> kernel version the node booted. >>>=20 >>> Use `wtmpdb last` as a replacement for the well-known `last`, since >>> the latter became obsolete [0] with Debian Trixie / PVE 9. >>>=20 >>> # wtmpdb last reboot --fulltimes --limit 5 >>> reboot system boot 7.0.14-5-pve Mon Jul 20 14:22:34 2026 - stil= l running >>> reboot system boot 7.0.14-5-pve Thu Jul 16 15:12:16 2026 - cras= h >>> reboot system boot 7.0.14-5-pve Thu Jul 16 11:20:15 2026 - Thu = Jul 16 15:10:46 2026 (03:50) >>> reboot system boot 7.0.14-5-pve Wed Jul 15 13:39:34 2026 - cras= h >>> reboot system boot 7.0.14-2-pve Wed Jul 15 07:39:18 2026 - Wed = Jul 15 13:38:04 2026 (05:58) >>>=20 >>> wtmpdb begins Wed Jul 15 07:39:18 2026 >>>=20 >>> [0] https://www.debian.org/releases/trixie/release-notes/issues.html#th= e-last-lastb-and-lastlog-commands-have-been-replaced >>>=20 >>> Signed-off-by: Alexander Zeidler >>> --- >>> PVE/Report.pm | 1 + >>> 1 file changed, 1 insertion(+) >>>=20 >>> diff --git a/PVE/Report.pm b/PVE/Report.pm >>> index 29433d4a..6049c0bf 100644 >>> --- a/PVE/Report.pm >>> +++ b/PVE/Report.pm >>> @@ -36,6 +36,7 @@ my $init_report_cmds =3D sub { >>> 'hostname', >>> 'date -R', >>> 'cat /proc/cmdline', >>> + 'wtmpdb last reboot --fulltimes --limit 5', >> >> we nowhere depend on wtmpdb so it's not a given that it's installed. > > OK, that is not ideal. Afaik only libpam-wtmpdb "Recommends" wtmpdb > (according to debtree). ``` # apt rdepends wtmpdb wtmpdb Reverse Depends: Recommends: acct Recommends: libpam-wtmpdb Suggests: util-linux Recommends: libpam-lastlog2 Enhances: chkrootkit ``` At least on a new PVE 9.2 installation `wtmpdb` is pre-installed, and `last` is a symlink to it. For older installations which have only `last` installed, the following line may be an alternative (beside simply not getting the information): `wtmpdb last reboot --fulltimes --limit 5 || last reboot -F -n5` > >> For just the boots we could use "journalctl --list-boots -n 5 -r". >> Depending on wtmpdb and writing yet another log file just for kernel ver= sion might >> be a bit overkill, given that the info is there in the journal, albeit i= t *is* >> annoying that we would have to manually parse them from the journal... > > For the purposes of support we are more interested about the kernel > version used each boot. It would be interesting to have info about the > BOOT IDs or having the timestamp of the last entry for a give boot > though. > > Another consideration of journalctl is that the boots might be rotated > away. While the mentioned `journalctl --list-boots -n 5 -r` does not include the booted kernel versions, it lists at least a close timestamp of the crash. I am not aware of a rotation issue, i.e., I think any rotation may apply to the same extent to `wtmpdb` and `last`. Although a minor problem can be when using e.g. the following command and there was no reboot since then. But in such seldom cases we likely have to ask for more specific journal information anyway. `journalctl --since "3 months ago" -g "Command line:|Journal stopped" -q | = tail` The command is limited to 3 months, since the query can take several seconds for journals that are flooded with entries. The advantage is, that it also contains the kernel command lines used. A crash timestamp is not available, but boot timestamps (usually shortly after finally crashed) and whether a reboot/shutdown was performed gracefully. > >>> 'pveversion --verbose', >>> 'cat /etc/hosts', >>> 'pvesubscription get',