log shows VM was shutdown. Would like to know what could be other way to show customer if VM was powered off and at what time.

Issue

Customer reported issue that application(Red Hat AMQ )server is down. When we investigated we found that some trace of Power Off in /var/log/messages. At the same time AMQ application came down. We informed customer that probably someone powered off the VM and therefore AMQ went down. Below are excerpt of /var/log/message and AMQ artemis.log to show you that this incidence happened at same time i.e. at 15:27pm on 18th June.

/var/log/messages

<30/3>6 Jun 18 15:20:01 <me-activemq-2> <systemd>: Starting Session 57690 of user root.
<30/3>6 Jun 18 15:20:01 <me-activemq-2> <systemd>: Started Session 57691 of user root.
<30/3>6 Jun 18 15:20:01 <me-activemq-2> <systemd>: Starting Session 57691 of user root.
<30/3>6 Jun 18 15:20:01 <me-activemq-2> <systemd>: Removed slice User Slice of root.
<30/3>6 Jun 18 15:20:01 <me-activemq-2> <systemd>: Stopping User Slice of root.
<38/4>6 Jun 18 15:27:45 <me-activemq-2> <systemd-logind>: Power key pressed.
<38/4>6 Jun 18 15:27:45 <me-activemq-2> <systemd-logind>: Powering Off...
<37/4>5 Jun 18 15:27:45 <me-activemq-2> <systemd-logind>: System is powering down.
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopped target Timers.
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopping Timers.
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopped target Multi-User System.
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopping Multi-User System.
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopping irqbalance daemon...
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopping SYSV: JBOSS FUSE...
<30/3>6 Jun 18 15:27:45 <me-activemq-2> <systemd>: Stopped Execute cloud user/final scripts.

artemis.log/messages

2019-06-18 12:31:44,773 INFO  [org.apache.activemq.artemis.core.server] AMQ221048: Consumer 47f33f7f-91e6-11e9-a212-fa163e542c84:0 attached to queue 'sample-fa163e542c84.ActiveMQServerImpl_serverUUID=8c06852a-91e0-11e9-8c32-fa163e542c84' from /IP:41047 identified as 'slow.' Expected consumption rate: 10 msgs/second; actual consumption rate: 3.16 msgs/second.
2019-06-18 15:27:45,269 INFO  [org.apache.activemq.artemis.core.server] AMQ221029: stopped bridge $.artemis.internal.sf.amq_cluster_configuration.8bee422d-91e0-11e9-8f88-fa163e3e5d9a
2019-06-18 15:27:45,525 INFO  [org.apache.activemq.artemis.core.server] AMQ221029: stopped bridge $.artemis.internal.sf.amq_cluster_configuration.8c06852a-91e0-11e9-8c32-fa163e542c84
2019-06-18 15:27:46,146 INFO  [io.hawt.web.AuthenticationFilter] Destroying hawtio authentication filter
2019-06-18 15:27:46,241 INFO  [org.apache.qpid.dispatch.PluginContextListener] Destroyed dispatch-hawtio-console plugin
2019-06-18 15:27:46,246 INFO  [org.apache.activemq.hawtio.plugin.PluginContextListener] Destroyed artemis-plugin plugin
2019-06-18 15:27:46,250 INFO  [io.hawt.branding.plugin.PluginContextListener] Destroyed hawtio-redhat-fuse-branding plugin
2019-06-18 15:27:46,258 INFO  [org.apache.activemq.artemis.core.server] AMQ221002: Apache ActiveMQ Artemis Message Broker version 2.6.1.amq-720004-redhat-1 [98f73409-91e0-11e9-bbfd-fa163e36c085] stopped, uptime 2 hours 58 minutes

• Issue is when I run uptime command on VM it gives me below result. Which basically shows that VM was up for last 20 hours which contradict with "Power Off" trace in /var/log/message that shows that power off took place around 6 hours back only.

[emsuser@me-activemq-2 log]$ uptime
 20:02:46 up  4:34,  1 user,  load average: 0.00, 0.01, 0.05