Redhat Unscheduled Reboot

Hi,

I have had an unscheduled reboot and would like to know the best place to start to find out what happened. am aware "messages" and "dmesg" is a good start but other options would be great.

p.s. not hardware - I have checked
lm-exchangeAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
If your hardware includes logs, check whether there was a power related event.
ps1 lost power, ps2 lost power.
if you have kdump configured you can check to see whether the reboot was caused by a kernel panic and using the kdump file, you can look at exploring what happened.
If you log sudo data into its own file, check that.
0
legolasthehansyCommented:
Also check using the "last" command and see the last column or so for a message (sometimes it can say "crash" or "reboot" etc..)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lm-exchangeAuthor Commented:
Hi, I checked "last" and it did list Reboot, matched time it happen too.
Is there a way how to find out what actioned the reboot based on the information pointing "reboot" listed in last output ?
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

legolasthehansyCommented:
Your best bet is /var/log/messages. Check the time it was rebooted on this file. It depends also on what services your server serve. If it is an application based server check that application logs to see if it gives you clues though the chances are remote an application can force the system to reboot.
0
arnoldCommented:
It should tell you the users who had sessions at the time, it could very well be an error that the person thought they were on a different server when they issued a reboot.
look at /var/log/secure if that is where you sshd logs to see who logged in before this reboot as well as who logged in immidiately after the system came back up. (i.e. user with admin rights mistakenly issued the reboot, and relogged in to make sure all was functional).
0
PsiCopCommented:
Also, make sure it isn't some cron job. We got nipped by unexpected reboots because we had a cron job set up as part of our automated patching. If a system was patched and rebooted on the 31st day of the month, anacron (which regards all months as having 30 days) would think the cron job was missed and re-run it.

Our solution was to disable anacron - it was designed for systems that aren't on all the time, or which switch back and forth between OSes (e.g. dual-boot), and which might need to "catch up". It is enabled by default in RHEL, but for always-on servers already running cron, using anacron is pointless.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.