[systemd-devel] Antw: [EXT] Re: --Reboot-- lines in journal

[Ulrich Windl]

>>> Dave Howorth <systemd at howorth.org.uk> schrieb am 14.05.2020 um 17:11 in
Nachricht
<13203_1589469111_5EBD5FB7_13203_37_1_20200514161137.1d96762f at acer-suse.lan>:

> On Thu, 14 May 2020 16:12:49 +0300
> Mantas Mikulėnas <grawity at gmail.com> wrote:
>> On Thu, May 14, 2020 at 3:55 PM Dave Howorth <systemd at howorth.org.uk>
>> wrote:
>> 
>> > What do --Reboot-- lines in the journal mean and how do they get
>> > there?
>> >
>> > I can't find any explanation on
>> > https://www.freedesktop.org/software/systemd/man/journalctl.html or
>> > related pages I've tried.
>> >
>> > I should explain why I'm interested. On my openSUSE box, I can see
>> > for example:
>> >
>> > # journalctl --list-boots
>> > -1 3c9ab70ade084dfab277efe733e18949 Mon 2020-03-02 23:44:11 GMT—Sun
>> > 2020-03-29 08:54:38 BST
>> >  0 c56183ea7877444a8252dd89a32b31f3 Sun 2020-03-29 09:15:30 BST—Thu
>> > 2020-05-14 13:16:49 BST
>> > # journalctl | grep Reboot
>> > -- Reboot --
>> > #
>> >
>> > Which looks fairly sane with what I think I should expect. But on
>> > two Raspberry pis that I have with persistent logging enabled they
>> > both have a huge excess of --Reboot-- lines. For example:
>> >
>> > $ sudo journalctl --list-boots
>> > -3 a9346655ca5d4700ab470bfd1b94d5da Thu 2019-02-14 10:11:59 GMT—Wed
>> > 2020-05-13 18:31:22 BST
>> > -2 c4f8ab5ec73b40818b1607b3436b90b5 Wed 2020-05-13 18:32:51 BST—Wed
>> > 2020-05-13 18:46:29 BST
>> > -1 0af9c854355f4a12a64dd00e6d3d98c1 Wed 2020-05-13 19:32:57 BST—Wed
>> > 2020-05-13 22:33:24 BST
>> >  0 fc5b35dbb3604dfbb4e2cdc99e117a75 Wed 2020-05-13 22:33:24 BST—Thu
>> > 2020-05-14 12:46:07 BST
>> > $ sudo journalctl | grep Reboot | wc
>> >    1667    5047   22095
>> > $
>> >
>> > What do the apparently excess 1664 --Reboot-- messages mean?
>> >  
>> 
>> The "--Reboot--" line is simply shown every time the _BOOT_ID field
>> changes between two entries -- even if it changes to a previously
>> seen boot ID (which shouldn't happen normally, but *might* be caused
>> by lack of a RTC?).
>> 
>> Meanwhile --list-boots has a bit more complex logic for discovering
>> the boots, and it also stops the search completely if it finds a boot
>> ID that it has already seen.
>> 
>> (What do you get from, let's say, `journalctl -o json | jq -r
>> "._BOOT_ID" | uniq -c`? Does it show several distinct ranges for each
>> boot ID?)
> 
> Thanks for the reply. A lot of lines similar to this (from start):
> 
>       2 4449e609d5144646b1bf70028bf8f1d0
>      59 bc489744282a46ffbc28fd31de4c6aa9
>      62 3164d610039145b4a1f7bc964eaaa85b
>     450 a9346655ca5d4700ab470bfd1b94d5da
>       1 4449e609d5144646b1bf70028bf8f1d0
>      27 4e807f1301de45dfb4e13551ae10a287
>       1 bc489744282a46ffbc28fd31de4c6aa9
>       2 4e807f1301de45dfb4e13551ae10a287
>       1 4449e609d5144646b1bf70028bf8f1d0
>       2 4e807f1301de45dfb4e13551ae10a287
> 
> I've attached the complete list, FWIW
> 
> I've never even heard of a _BOOT_ID before, so it seems I'll need to do
> some reading to answer my original questions. Where's a good place to
> start?

It's a kernel feature, so docs should come from the kernel. As a quick start:
;-)
cat /proc/sys/kernel/random/boot_id

Regards,
Ulrich

> 
>> -- 
>> Mantas Mikulėnas