How does my sys admin know that I haven't rebooted my system?

Question

I got an email from my system administrator saying that I needed to reboot my system to apply some patches. I had forgotten about it and after a couple of hours I got another mail telling me that I was yet to reboot my system.

I have since rebooted my system but I'm surprised how they'd know if I had rebooted my machine or not. Can someone explain how this works?

Wow, I never realized that there were so many ways. Thanks guys! — nikhil, Jan 26 '13 at 18:04

score 43 · Accepted Answer · edited Apr 13 '17 at 12:25

43

A quick way to check this remotely can be done using SNMP (provided your SysAdmin has set this up on your network):

admin@yourcompany:~$ snmpwalk -v 2c -c <snmpstring> MachineName sysUpTimeInstance
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (9461615) 1 day, 2:16:56.15

Most likely, the data would be polled and stored in a network management/monitoring system of some sort (i.e. Nagios or Cacti).

In case anyone is interested in playing around with the snmpwalk command, see the answer here to get a basic SNMP configuration set up on your system.

edited Apr 13 '17 at 12:25

Community

1

answered Jan 21 '13 at 08:24

Kevin Bowen

19,615
55
79
83

Nice one. Someone here created a script that looks a bit hard to maintain and this one liner looks nice :D Thanks and have an upvote ;) – Rinzwind Jan 21 '13 at 08:31
@Rinzwind Thanks. Here is another one-liner I use sometimes sudo hping3 -c 2 -p 80 --tcp-timestamp -S <IPaddress> 2>&1 | grep uptime – Kevin Bowen Jan 21 '13 at 09:02
Every regular piece of monitoring software can do thi this, however SNMP is the most common one and this a nice example. +1. – gertvdijk Jan 21 '13 at 09:46

score 28 · Answer 2 · edited Apr 13 '17 at 12:14

28

A simple method will be to check the output of the uptime command, which shows how long you have been running the system without a shutdown/restart.

Sample Output:

saji@geeklap:~$ uptime
12:41:29 up  3:08,  2 users,  load average: 1.06, 0.85, 0.86

It says that my system has been powered on for 3 hours and 8 minutes.

The admin can set up a shell script to either make use of uptime or to use some other method, as detailed in this link. Another method the admin can utilise is to setup an email to be send at system shutdown or restart, the details are available at this link.

edited Apr 13 '17 at 12:14

Community

1

answered Jan 21 '13 at 07:14

saji89

12,007

COuld this be done remotely if they didn't have access to log into my machine? – nikhil Jan 21 '13 at 07:39
1

An admin will most surely have access to your system, for administrative purposes. :) – saji89 Jan 21 '13 at 07:55
5

unlikely @saji89 An admin has better things to do then to check every system locally for uptime... – Rinzwind Jan 21 '13 at 08:09
2

@Rinzwind, I wasn't telling that he should be using it. I was just pointing out that he will have the access to the machine. In this particular case, the admin had reasons to check. :) – saji89 Jan 21 '13 at 08:27
1

Ah ok. But I got better things to do then to check systems' uptime ;) @saji89 – Rinzwind Jan 21 '13 at 08:29
@Rinzwind, Ya sure, I know.. ;) – saji89 Jan 21 '13 at 08:35

score 9 · Answer 3 · edited Apr 13 '17 at 12:23

@saji89 mentioned the uptime command. I'll go one step lower, and simply posit that the sysadmin has a script somewhere that connects to each computer and does a cat /proc/uptime (or something equivalent). The first field of the output is the time, in seconds, since the system was last rebooted, which is much easier to parse than the output of uptime. For example, my computer gives a first uptime field of 1441218.24 with uptime returning up 16 days, 16:20. 1441218 seconds is 16 days plus 58818 seconds, and 58818 seconds is 16 1/3 hours. 16 days 16 1/3 hours.

When you know the maximum length of time since the system should have been rebooted, this data makes it trivial to check to see if the system has been rebooted since then or not.

It could be done through a monitoring tool such as Nagios, or through a separate script that the sysadmin keeps on his computer (or rather accessible through it, I'd imagine) which connects to each computer in turn or in parallell and prints the time since last reboot in some format. That all depends on how elaborate to make it.

arielf · Answer 4 · 2013-03-04T18:30:20.013

8

Another way, just for the sake of completeness, is to look at /var/log/wtmp via the last command. Example:

$ last reboot
reboot   system boot  3.2.0-36-generic Thu Jan 24 16:25 - 17:42 (1+01:17)   

wtmp begins Tue Jan  1 06:30:03 2013

This method is a favorite because it also happens to be the perfect mnemonic.

Q: When did the last reboot occur? 
A: Just type 'last reboot'

edited Mar 04 '13 at 18:30

answered Jan 26 '13 at 01:45

arielf

2,823

score 7 · Answer 5 · answered Jan 21 '13 at 14:21

7

When a package that requires a reboot has been updated via apt, a file called reboot-required is created into /var/run/. The sysadmin can check for the presence of this file remotely to determine if a reboot is required due to updates.

answered Jan 21 '13 at 14:21

aleksikallio

203

The OP was asked by the sysadmin to reboot the computer "to apply some patches". At least to me, this implies that the actual update happens through some mechanism during the boot process. (Maybe a boot script executing something along the lines of apt-get -y upgrade.) So there would be no reboot-required because from apt's perspective, a reboot isn't required yet. – user Jan 22 '13 at 09:05
2

I doubt that this is the case, because the user would have to reboot twice if the updates require a reboot after installing, and if there are no updates that require a reboot, the sysadmin could just remotely run that same script and update in the background. Without knowing more, I'd guess that there was a kernel image upgrade (or something other requiring a reboot), and the user had to reboot to apply the new kernel. But this is just guesswork. – aleksikallio Jan 22 '13 at 09:32

Rinzwind · Answer 6 · 2013-01-21T08:26:26.783

This ...

to apply some patches

is the key part.

If the admin is any good he probably set up the updates from HIS machine so the PC's do not have to download the same file from the web. If so he can see from his own machine who downloaded the patches.

He then only has to look at the IP addresses of those systems that did load the patches and send and email to those that did not. That email can even be an automatically generated mail. Imagine there are 500 machines. Manually checking each of them is a waste of time if there are several methods where he can do from his own machime.

1 very important reason for doing it this way: an admin needs to have control on what is happening on the systems he needs to maintain. So he should always have a single point of control (ie. his own machine where he has all the tools) where he can see the status of any machine.

You may need to reboot to apply the patches, no guarantee that the download happens only at the reboot. — Karthik T, Jan 21 '13 at 08:57

score 2 · Answer 7 · answered Jan 21 '13 at 08:56

There are several valid methods described in the answers. Logging in and checking the uptime would be strange for a large company, but doable for a smaller one. The sysadmin could have been checking via SNMP, but the same "trouble" argument could be used there.

The most likely situations are, as far as I'm concerned:

The sysadmin runs some sort of checking-software, probably Nagios, that checks clusters of computer for problems. Something like the NRPE plugin will be used for most systems and can show you uptime (apart from disc, logged in users, etc).
A similar method can be used to check what is running where. If the to-be-updated-patches can be checked (what kernel are you using), the "are all users updated" script will be still pointing at your computer for being in a 'bad' state.

score 1 · Answer 8 · answered Feb 09 '13 at 12:19

1

If the system is connected to a network he controls, the sysadmin can simply look at the switch or the dhcp server to see how long your network connection has been active. That will also tell him you have not rebooted.

answered Feb 09 '13 at 12:19

Dennis Kaarsemaker

6,854

How does my sys admin know that I haven't rebooted my system?

8 Answers8