Get more information about the crash

Question

When I issue the command last in my terminal I see the following entries i.e. "crash":

i meant the command last " show listing of last logged in users".

root@lab18:~# last
tito     pts/3        x.x.x.x   Tue Nov 13 16:22   still logged in
tito     pts/3        x.x.x.x   Tue Nov 13 09:13 - 16:22  (07:09)
reboot   system boot  3.2.0-32-generic Mon Nov 12 23:58 - 16:22  (16:24)
tito     pts/1        192.168.26.5     Mon Nov 12 23:56 - crash  (00:01)
tito     pts/4        192.168.26.5     Mon Nov 12 22:46 - crash  (01:12)


uname -a
Linux HomeServer 3.2.0-32-generic-pae #51-Ubuntu SMP Wed Sep 26 21:54:23 UTC 2012 i686 i686 i386 GNU/Linux
last reboot
reboot   system boot  3.2.0-32-generic Mon Nov 12 23:58 - 16:29  (16:31)
wtmp begins Thu Nov  1 10:17:16 2012

I have found some information about the crash in the syslog and the kernel.log However i was curious if various linux distributions (ubuntu) is writing some other files other than the syslog or kernel.log where specific information about the crash can be decoded. And what I mean is for example many networking vendors do i.e. cisco, hp, juniper, enterasys do have syslog, current.log files, SNMP informs/traps messages, that are saved to some sort of place locally on the file system or remotely in case an even occur, however they also have specifically designed files such as systemDumps where a backtrace from the callstack can be found and analyzed in case a crash occur and occasionally this could help to debug the problem. So the question is does Ubuntu has also such kind of place where information is being stored about the crash.

Regards,

Tito

Solution

It is not really clear where these lines come from, what has crashed, etc. What 'last' command are you running? As far as I know, the last command you would normally run is this one: show listing of last logged in users (from its man-page).

Are you checking last reboot ? If so and this means your system crashed before a reboot, you can start by checking out the system logs:

less /var/log/syslog

or, if that is too new

less /var/log/syslog.1

If you need an older entry they are most likely gzipped, zo use

zcat /var/log/syslog.2.gz

In some versions (server install) you might need special permissions to read these files, so if you get a

/var/log/syslog: Permission denied

error you need to prepend your commands with sudo

sudo less /var/log/syslog

Comments

[Nanne]

@Mik : I believe you are incorrect in your edit: on my system we have this -rw-r----- 1 syslog adm 16K Nov 13 11:30 syslog and my user does need to use sudo to read it.

[Admin]

On my Ubuntu 12.04 LTS sudo is not needed and it isn't normally needed at least for desktop systems.

[Nanne]

There wasn't a mention of which version and seeing that there are versions that require this (and there is as far as I know no issue in using an extra 'sudo' command), it seems to me that leaving the sudo in place is the best option? (btw, I wasn't planning on an edit-war, we could meet in the middle and just add this conversation in the answer?)

[Admin]

Yes, you can put a note about it in the answer.

[Tito]

Hello sorry for the misunderstanding i have edited the question and made it more detailed.

[Nanne]

the answer is still syslog as far as I know. Depending on what the syslog says, you might find more in another place.