系统： centos 7
Linux系统异常重启后的messages日志分析

1） 关于last-x命令的输出
运行此命令并将输出与以下示例进行比较：

last -x | head | tac

正常停机示例

正常关机和通电如下所示：

runlevel (to lvl 0)   2.6.32- Sat Mar 17 08:48 - 08:51  (00:02) 
shutdown system down  ... <-- first the system shuts down   
reboot   system boot  ... <-- afterwards the system boots
runlevel (to lvl 3)     

在某些情况下，您可能会看到这一点（请注意，没有关于关机的行，但系统处于运行级别0，即“暂停状态”）：

runlevel (to lvl 0)   ... <-- first the system shuts down (init level 0)
reboot   system boot  ... <-- afterwards the system boots
runlevel (to lvl 2)   2.6.24-... Fri Aug 10 15:58 - 15:32 (2+23:34)   

意外关机示例
断电导致的意外关机如下所示：

runlevel (to lvl 3)   ... <-- the system was running since this momemnt
reboot   system boot  ... <-- then we've a boot WITHOUT a prior shutdown
runlevel (to lvl 3)   3.10.0-693.21.1. Sun Jun 17 15:40 - 09:51  (18:11)   

2） 关于登录/var/log/
过滤日志消息的bash命令如下：

grep -iv ': starting\|kernel: .*: Power Button\|watching system buttons\|Stopped Cleaning Up\|Started Crash recovery kernel' \
  /var/log/messages /var/log/syslog /var/log/apcupsd* \
  | grep -iw 'recover[a-z]*\|power[a-z]*\|shut[a-z ]*down\|rsyslogd\|ups'

当发生意外断电或硬件故障时，文件系统将无法正确卸载，因此在下一次引导中，您可能会得到如下日志：

EXT4-fs ... INFO: recovery required ... 
Starting XFS recovery filesystem ...
systemd-fsck: ... recovering journal
systemd-journald: File /var/log/journal/.../system.journal corrupted or uncleanly shut down, renaming and replacing.

当系统因用户按下电源按钮而关机时，您会得到如下日志：

systemd-logind: Power key pressed.
systemd-logind: Powering Off...
systemd-logind: System is powering down.

只有当系统有序关闭时，才会得到如下日志：

rsyslogd: ... exiting on signal 15

当系统因过热而关闭时，会出现如下日志：

critical temperature reached...,shutting down