Logrotate

Ref ​here

[root@Mosh ActDas]# more /etc/logrotate.d/actdaslog 
/tmp/ActDasLog/*.log
{
        su krit krit
        rotate 7
        daily
        size 5M      # place size after daily, it will process if file log > 5M ignore daily
        copytruncate #copy to actdas.log.1 and empty actdas.log to zero 
        missingok
        notifempty
        delaycompress
        compress
}

To run the logroate file with -f force option

[root@Mosh logrotate.d]# logrotate -f /etc/logrotate.d/actdaslog --state /tmp/logrotate-state --verbose

After run we should see

[krit@Mosh ActDasLog]$ tree /tmp/ActDasLog/
/tmp/ActDasLog/
├── mosq_feed_actDas_11_firmware.log
├── mosq_feed_actDas_11_firmware.log.1
├── mosq_feed_actDas_11_firmware.log.2.gz
├── mosq_feed_actDas_11_firmware.log.3.gz
└── mosq_feed_actDas_11_firmware.log.4.gz

0 directories, 5 files
[krit@Mosh ActDasLog]$

If logrotate run daily, it will update the state in /var/lib/logrotate/status

Proper shutdown Log

Ref​here

With a simple last -Fxn2 shutdown reboot command (F=fulltime, x=system entry, n=limit number line), the system wtmp file reports the two most recent shutdowns or reboots. reboot denotes the system booting up; whereas, shutdown denotes the system going down.

A graceful shutdown would show up as a reboot line followed by shutdown line, as in the following example:

~]# last -Fxn2 shutdown reboot
reboot   system boot  4.18.0-80.el8.x8 Mon Aug 31 06:33:11 2020   still running
shutdown system down  4.18.0-80.el8.x8 Mon Aug 31 06:23:01 2020 - Mon Aug 31 06:23:11 2020  (00:10)

An ungraceful shutdown can be inferred by the omission of shutdown; instead there will either be a single reboot line (if the wtmp file had been truncated/rotated prior to the crash) or 2 reboot lines in a row, as in this example:

~]# last -Fxn2 shutdown reboot
reboot   system boot  4.18.0-147.5.1.e Tue Sep  1 07:16:25 2020   still running
reboot   system boot  4.18.0-147.5.1.e Mon Aug  3 07:10:56 2020   still running