Solved

Redhat Unscheduled Reboot

Posted on 2012-03-29
6
322 Views
Last Modified: 2012-06-27
Hi,

I have had an unscheduled reboot and would like to know the best place to start to find out what happened. am aware "messages" and "dmesg" is a good start but other options would be great.

p.s. not hardware - I have checked
0
Comment
Question by:lm-exchange
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 78

Expert Comment

by:arnold
ID: 37785656
If your hardware includes logs, check whether there was a power related event.
ps1 lost power, ps2 lost power.
if you have kdump configured you can check to see whether the reboot was caused by a kernel panic and using the kdump file, you can look at exploring what happened.
If you log sudo data into its own file, check that.
0
 
LVL 11

Accepted Solution

by:
legolasthehansy earned 500 total points
ID: 37787672
Also check using the "last" command and see the last column or so for a message (sometimes it can say "crash" or "reboot" etc..)
0
 

Author Comment

by:lm-exchange
ID: 37788711
Hi, I checked "last" and it did list Reboot, matched time it happen too.
Is there a way how to find out what actioned the reboot based on the information pointing "reboot" listed in last output ?
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 11

Expert Comment

by:legolasthehansy
ID: 37788788
Your best bet is /var/log/messages. Check the time it was rebooted on this file. It depends also on what services your server serve. If it is an application based server check that application logs to see if it gives you clues though the chances are remote an application can force the system to reboot.
0
 
LVL 78

Expert Comment

by:arnold
ID: 37788834
It should tell you the users who had sessions at the time, it could very well be an error that the person thought they were on a different server when they issued a reboot.
look at /var/log/secure if that is where you sshd logs to see who logged in before this reboot as well as who logged in immidiately after the system came back up. (i.e. user with admin rights mistakenly issued the reboot, and relogged in to make sure all was functional).
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 37791127
Also, make sure it isn't some cron job. We got nipped by unexpected reboots because we had a cron job set up as part of our automated patching. If a system was patched and rebooted on the 31st day of the month, anacron (which regards all months as having 30 days) would think the cron job was missed and re-run it.

Our solution was to disable anacron - it was designed for systems that aren't on all the time, or which switch back and forth between OSes (e.g. dual-boot), and which might need to "catch up". It is enabled by default in RHEL, but for always-on servers already running cron, using anacron is pointless.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

rdate is a Linux command and the network time protocol for immediate date and time setup from another machine. The clocks are synchronized by entering rdate with the -s switch (command without switch just checks the time but does not set anything). …
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question