On Monday 21 March 2005 6:19 pm, Tim Green wrote:
Is it possible to tell the difference (after the event) between a power cycle and someone leaning on the reset switch?
There is a way I have used in the past when proving/disproving that power cuts were the reason a machine was "crashing"
Unfortunately it requires that you gather some information before the event and that you have tight control over said machine (i.e. you know every time it is power cycled) and is currently unlikely to work if you are running SATA drives
Most modern IDE (and some SCSI) hard drives have SMART firmware that runs on device diagnostics and performance monitoring. Part of this includes a power cycle count, the power cycle count does not get rolled over on a reset button press, the PSU in the machine has to be physically powered down (either by the front button or the removal of power). You can query the firmware using smartctl which is part of the smartmon tools package.
It is quite a useful method as it is extremely non-trivial to modify or delete the drives event log and is therefore very difficult to hide before or after the event.
Smartmon tools is a very useful package, there is quite an interesting pool of information held within a hard drives firmware and there are even dameons that will help predict impending drive failure (they have saved me at least twice before, so I tend to run them on any important machine)
To effectively use the diagnostic portions of smartmon tools you need to tell the drive to perform either a online or offline test (at which point it will estimate how long such a test is likely to take) and then check back with a query after that time has passed, however for things like drive run hours and power cycle counts, you just simply need to run something like smartctl -a /dev/hda and look for the power cycle count in the output.
Another thing worth doing on new drives is to power them up and run the conveyance tests that are designed to check for rough handling damage. I have rejected new drives in the past based on the output of these tests.
As with anything storage related, I strongly suggest a read of the man file before playing on a live machine.
W