On Mon, Jan 23, 2017 at 2:18 PM, Greg Wooledge <wool...@eeg.ccf.org> wrote:

> On Mon, Jan 23, 2017 at 02:12:04PM -0400, francis picabia wrote:
> > I'm running Debian 8.6, and looking at old logs.  I'd like to confirm
> when
> > the system was rebooted to invoke the newer kernel which fixed
> > the Dirty COW bug.
>
> last | grep boot
>
> or, apparently (according to the man page):
>
> last reboot
>
> > If I have a complete
> > copy of my /var/log from last October,
>
> Urghhh.  So it's not on a live system?  It's on a chrooted disk image?
> Then I think you need to use:
>
> last -f /some/path/wtmp reboot
>
> where /some/path/wtmp is the location of your chrooted disk image's
> wtmp file.
>
>
I think I said I already tried that.  There are no results from last
pointed to any recovered wtmp file.  It is a recovery of /var/log
from backup tape.

I even have psacct on that system.  A command like
lastcomm -f pacct | grep boot
is returning nothing.

Reply via email to