1

When I issue

last | grep root

in terminal to check login histories to my server, from among various lines, I also get the following.

root     pts/0        IP address    Mon Jun 16 15:03 - crash (50+08:39) 

I just want to know what the "crash (50+08:39)" part mean?

PS: Since I have newly installed the OS, I suspect the IP address belongs to the company I bought the VPS from.

developer
  • 555

1 Answers1

2

It means root had been logged in for 50 days, 8 hours and 39 minutes, on pts/0, from the IP address specified, when the system crashed. From the timings, I'm guessing the system crashed around 23:42 local time on Aug 5.

Edit: It depends on what your VPS does under the hood when you click "reinstall the OS", and without asking your provider, there's no way of knowing that. If you had done a complete, clean reinstall of the OS, re-mkfs'ing the file systems and reinstalling all content, I don't think any login information could possibly have persisted across that. But since login information did persist, we can only infer that your VPS provider does something less than a complete wipe-and-reinstall when you ask for a rebuild.

Since you say you did a "rebuild" yesterday, from the other information provided I'm guessing that your VPS provider left a stray root login hanging around - possibly on some kind of virtual console - for some time, and that when you clicked on "rebuild the OS" that login was terminated as part of the rebuild.

But without talking to your VPS provider for specifics, there's no way to be sure.

MadHatter
  • 80,590