Linux system with kernel 4.14.76 and last from util-linux 2.35.1.
I am using last -x reboot shutdown to detect abrupt shutdowns and power loss. To my understanding, a clean reboot should show as a pair of shutdown and reboot entries in wtmp. This is supported by e.g. this article. An ungraceful shutdown or powerless can be inferred thorough sequential reboot entries with no shutdown in between.
However, I am finding that there isn't always a shutdown entry when I run systemctl reboot - I often see sequential reboot entries and user sessions are listed as crash. Sometimes however, we do get both shutdown and reboot entries logged.
Example where I ran systemctl reboot 4 times:
$ last -x reboot shutdown reboot system boot 4.14.76-6.1.0-so Wed Aug 31 13:12 still running shutdown system down 4.14.76-6.1.0-so Wed Aug 31 13:12 - 13:12 (00:00) reboot system boot 4.14.76-6.1.0-so Wed Aug 31 12:56 - 13:12 (00:15) reboot system boot 4.14.76-6.1.0-so Wed Aug 31 11:24 - 13:12 (01:47) reboot system boot 4.14.76-6.1.0-so Wed Aug 31 11:23 - 13:12 (01:48) shutdown system down 4.14.76-6.1.0-so Wed Aug 31 11:22 - 11:23 (00:00) I have only found one question that directly addresses this but sadly it is locked behind RHEL subscription.
I am not dual-booting as per this other SE question, which may itself be an instance of inconsistent shutdown logging in wtmp.
Does anyone know why reboots via systemctl would not consistently log shutdown alongside reboot?
Is there a better way to reliably tell whether the system experienced unexpected reboots/power loss?
