On Mon, Jan 23, 2017 at 2:18 PM, Greg Wooledge <wool...@eeg.ccf.org> wrote:
> On Mon, Jan 23, 2017 at 02:12:04PM -0400, francis picabia wrote: > > I'm running Debian 8.6, and looking at old logs. I'd like to confirm > when > > the system was rebooted to invoke the newer kernel which fixed > > the Dirty COW bug. > > last | grep boot > > or, apparently (according to the man page): > > last reboot > > > If I have a complete > > copy of my /var/log from last October, > > Urghhh. So it's not on a live system? It's on a chrooted disk image? > Then I think you need to use: > > last -f /some/path/wtmp reboot > > where /some/path/wtmp is the location of your chrooted disk image's > wtmp file. > > I think I said I already tried that. There are no results from last pointed to any recovered wtmp file. It is a recovery of /var/log from backup tape. I even have psacct on that system. A command like lastcomm -f pacct | grep boot is returning nothing.
