Is there a way to determine whether a RHEL7 server was rebooted via systemctl (or reboot / shutdown aliases), or whether the server crashed? Pre-systemd this was fairly easy to determine with
last -x runlevel, but with RHEL7 it’s not so clear.
Funny, I just happened to reboot a CentOS 7 system last night, and so I have a nice log of just this to look at.
In the case of a crash, obviously nothing is logged between the time of the crash and the system restart.
In the case of a reboot, it is pretty obvious, as you get a log of (nearly) everything systemd is doing to shut down the system.
One such log entry you aren’t likely to see in any circumstance other than shutting down or going to single-user mode is:
Jul 13 01:27:55 yaungol systemd: Stopped target Multi-User System.
You can reboot your own system to see what actually gets logged.
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.