Francis Luong

View Original

JUNOS - Using The 'chassisd' Log To Determine Boot Times

You can use “show system uptime” to determine the time that the system last booted but if you need to know about how long the system was up prior to the last boot you have to dig a bit deeper.

 fluong@re0.mx960-1.eng> show system uptime 
 Feb 01 11:26:13
 Current time: 2013-02-01 11:26:13 EST
 System booted: 2013-01-04 10:34:28 EST (4w0d 00:51 ago)
 Protocols started: 2013-02-01 11:17:44 EST (00:08:29 ago)
 Last configured: 2013-02-01 11:17:45 EST (00:08:28 ago) by root
 11:26AM  up 28 days, 52 mins, 1 user, load averages: 0.02, 0.15, 0.13

The “messages” log, though handy, is also very noisy. Because of this, we can try to use the “chassisd” log instead and look for the “built by” string, which occurs each time the chassis control process initiates itself.

That line, unfortunately, is on the line after the timestamp, so we need some other nearby log messages to determine the rough time of system startup.

Also important to note is that the “built by” string occurs when you “restart chassis-control”, so we need to inspect those logs to see if a SIGTERM occurred within seconds of chassisd restarting. If it is a few minutes apart, that is probably a reboot. If it is seconds apart, that means someone triggered a process restart.

 fluong@re0.mx960-1.eng> show log chassisd | match "(built by|rtsock_init s|sigterm)" 
 Feb 01 11:28:45
 Dec 19 11:14:52 CHASSISD_TERM_SIGNAL: Received SIGTERM request, shutting down
 Dec 19 11:14:58 CHASSISD_TERM_SIGNAL: Received SIGTERM request, shutting down
 CHASSISD release 10.4R3.4 built by builder on 2011-03-19 21:10:47 UTC
 Dec 19 11:22:37 rtsock_init synchronous socket
 Jan  4 10:27:25 CHASSISD_TERM_SIGNAL: Received SIGTERM request, shutting down
 Jan  4 10:27:31 CHASSISD_TERM_SIGNAL: Received SIGTERM request, shutting down
 CHASSISD release 11.4R6.5 built by builder on 2012-11-28 21:35:45 UTC
 Jan  4 10:35:54  rtsock_init synchronous socket
 Feb  1 11:17:31 CHASSISD_TERM_SIGNAL: Received SIGTERM request, shutting down
 CHASSISD release 11.4R6.5 built by builder on 2012-11-28 21:35:45 UTC
 Feb  1 11:17:32  rtsock_init synchronous socket

We can tell from looking at these logs:

  • System was rebooted and chassisd started on Dec 19 11:22:37. Ditto, Jan 4 10:35:54.
  • “restart chassis-control” was invoked on Feb 1 11:17:31