= Logrotate =

Ref [https://www.baeldung.com/linux/rotating-logs-logrotate here][[br]]

{{{
#!sh
[root@Mosh ActDas]# more /etc/logrotate.d/actdaslog 
/tmp/ActDasLog/*.log
{
        su krit krit
        rotate 7
        daily
        size 5M      # place size after daily, it will process if file log > 5M ignore daily
        copytruncate #copy to actdas.log.1 and empty actdas.log to zero 
        missingok
        notifempty
        delaycompress
        compress
}

}}}

To run the logroate file with -f force option 
{{{
[root@Mosh logrotate.d]# logrotate -f /etc/logrotate.d/actdaslog --state /tmp/logrotate-state --verbose
}}}
After run we should see
{{{
#!sh
[krit@Mosh ActDasLog]$ tree /tmp/ActDasLog/
/tmp/ActDasLog/
├── mosq_feed_actDas_11_firmware.log
├── mosq_feed_actDas_11_firmware.log.1
├── mosq_feed_actDas_11_firmware.log.2.gz
├── mosq_feed_actDas_11_firmware.log.3.gz
└── mosq_feed_actDas_11_firmware.log.4.gz

0 directories, 5 files
[krit@Mosh ActDasLog]$

}}}

If logrotate run daily, it will update the state in /var/lib/logrotate/status 

= Proper shutdown Log
Ref[https://access.redhat.com/articles/2642741 here]

With a simple last -Fxn2 shutdown reboot command, the system wtmp file reports the two most recent shutdowns or reboots. reboot denotes the system booting up; whereas, shutdown denotes the system going down.

A graceful shutdown would show up as a reboot line followed by shutdown line, as in the following example:
{{{
~]# last -Fxn2 shutdown reboot
reboot   system boot  4.18.0-80.el8.x8 Mon Aug 31 06:33:11 2020   still running
shutdown system down  4.18.0-80.el8.x8 Mon Aug 31 06:33:01 2020 - Mon Aug 31 06:33:11 2020  (00:00)
}}}

An ungraceful shutdown can be inferred by the omission of shutdown; instead there will either be a single reboot line (if the wtmp file had been truncated/rotated prior to the crash) or 2 reboot lines in a row, as in this example:
{{{
~]# last -Fxn2 shutdown reboot
reboot   system boot  4.18.0-147.5.1.e Tue Sep  1 07:16:25 2020   still running
reboot   system boot  4.18.0-147.5.1.e Mon Aug  3 07:10:56 2020   still running
}}}