If you are talking retrospectively, then assuming reasonable defaults on ubuntu 16.04, you have the following options on (and possibly others... auditd maybe?) to inspect for activity:
- systemd journal
- log files in
/var/log/{auth,kern,syslog}.log
etc
- the Zabbix server itself
journalctl
I think that persistence of boot logs is disabled on ubuntu, so journalctl -b
is probably not that useful. But there is nothing stopping you bucketing the log entries and seeing which periods are "down-time" from all the cron and daemon related logging.
The following will dump out the number of log entries in the systemd journal in hourly chunks going back 1 week. And you can easily see if there was downtime...
START_STRING="1 week ago"
FORMAT="%Y-%m-%d %H:%M:%S"
next_date=$(date +%s -d "$START_STRING")
while [ "$next_date" -le "$(date +%s)" ]; do
curr_date=$next_date
next_date=$(date +%s -d "@$((next_date + 3600))")
curr_data_iso=$(date +"$FORMAT" -d "@$curr_date")
next_date_iso=$(date +"$FORMAT" -d "@$next_date")
echo -n "$curr_data_iso $next_date_iso "
count=$(journalctl --quiet --no-pager --since "$curr_data_iso" --until "$next_date_iso" | wc -l )
echo -n " $count "
[ $count -gt 100 ] && nummer=100 || nummer=$count
printf '=%.0s' $(seq 1 $nummer)
echo ""
done
echo ""
output is something like this
2018-02-05 03:44:26 2018-02-05 04:44:26 15 ===============
2018-02-05 04:44:26 2018-02-05 05:44:26 9 =========
2018-02-05 05:44:26 2018-02-05 06:44:26 18 ==================
2018-02-05 06:44:26 2018-02-05 07:44:26 9 =========
2018-02-05 07:44:26 2018-02-05 08:44:26 9 =========
2018-02-05 08:44:26 2018-02-05 09:44:26 9 =========
2018-02-05 09:44:26 2018-02-05 10:44:26 9 =========
2018-02-05 10:44:26 2018-02-05 11:44:26 121 ====================================================================================================
2018-02-05 11:44:26 2018-02-05 12:44:26 9 =========
2018-02-05 12:44:26 2018-02-05 13:44:26 9 =========
2018-02-05 13:44:26 2018-02-05 14:44:26 9 =========
2018-02-05 14:44:26 2018-02-05 15:44:26 9 =========
2018-02-05 15:44:26 2018-02-05 16:44:26 9 =========
2018-02-05 16:44:26 2018-02-05 17:44:26 9 =========
2018-02-05 17:44:26 2018-02-05 18:44:26 9 =========
2018-02-05 18:44:26 2018-02-05 19:44:26 9 =========
2018-02-05 19:44:26 2018-02-05 20:44:26 12 ============
2018-02-05 20:44:26 2018-02-05 21:44:26 9 =========
2018-02-05 21:44:26 2018-02-05 22:44:26 11 ===========
2018-02-05 22:44:26 2018-02-05 23:44:26 9 =========
2018-02-05 23:44:26 2018-02-06 00:44:26 9 =========
2018-02-06 00:44:26 2018-02-06 01:44:26 9 =========
2018-02-06 01:44:26 2018-02-06 02:44:26 16 ================
2018-02-06 02:44:26 2018-02-06 03:44:26 9 =========
2018-02-06 03:44:26 2018-02-06 04:44:26 9 =========
2018-02-06 04:44:26 2018-02-06 05:44:26 0 =