7

I have a webserver I think rebooted at some point .. mostly because apache wasn't serving sites and it usually does that when someone starts it and doesn't enter the SSL cert's password ... and a reboot/start fixed the problem. Looking around in /var/log/messages, the very first log entries today are:

Jun 30 05:17:40 localhost kernel: imklog 4.2.0, log source = /proc/kmsg started.
Jun 30 05:17:40 localhost rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="393" x-info="http://www.rsyslog.com"] (re)start
Jun 30 05:17:40 localhost rsyslogd: rsyslogd's groupid changed to 103
Jun 30 05:17:40 localhost rsyslogd: rsyslogd's userid changed to 101

I'm assuming that means it was a reboot, but I know so little about real server administration, I wanted to verify this. I can post the rest of messages if it would be helpful. The entry prior to these, was the following once per day:

Jun 29 06:34:11 localhost rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="350" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.

So do these indicate a server reboot as I am guessing? Is there any way to determine what caused the reboot? Or if a person did it?

1
  • 1
    Please use appropriate tags, such as what OS this relates to. Jul 1, 2012 at 0:54

5 Answers 5

10

Easiest way to see if it recently rebooted is just to type,

uptime

If you want to check over intentional reboots, then type,

lastlog

If there is no record of a deliberate reboot or power button press, yet it had restarted, you'll have to begin a standard diagnostic procedure to find out why it restarted. Start by looking ar server graphs for memory over allocation or overheating. There are quite a few things that can cause random reboots that won't log (kernel panic, watchdog etc.) - but remotely logging the serial console will give you this vital information.

2

uptime will show you how long it's been up since the last reboot.

last will show you the last logged in users, and it will also show you if it detects a regular reboot request.

who will show you who is logged on now. Make sure that you are the only one logged in or that you can account for all connections.

Of more importance are the lines before that syslog line. It might give us something, and it might not. Contact whomever is hosting your server and see if they had some kind of scheduled or unscheduled power outage or reboot. The most concerning thing is not that the server was rebooted, but that it was done without your knowledge. Also note that flaky or failing hardware can sometimes reboot on its own, so contacting your hosting provider to find out if they did it or detected anything should be your first step.

2

The "rsyslogd was HUPed" indicates that the rsyslog process restarted, and it's the last message because presumably it wasn't working before, and rsyslog is the process that would normally leave messages in the log. So when it restarts, the messages restart.

This is possibly related to a known Ubuntu bug, you can read more about it here http://ubuntuforums.org/showthread.php?t=1384521

Although alas nothing to suggest how to cure it. It's quite possible that the rsyslog issue is not connencted with the server restarts.

1

It might indicate a reboot. From what you gave us, I really can't tell. The logs you have posted indicate that the process rsyslogd restarted (from a HUP signal). I can't tell if a person did it or a program did it because both can send a HUP signal with the right permissions.

1
  • logrotate does that everyday..It sends kill -HUP signal to refresh the file descriptors
    – GP92
    May 29, 2018 at 13:53
0

That is exactly the log I see when my system starts up.

# cat /etc/redhat-release
CentOS release 6.4 (Final)
# cat /var/log/messages
Aug 19 12:04:22 [...] kernel: imklog 5.8.10, log source = /proc/kmsg started
[...]
Aug 19 11:49:17 [...] ntpd[935]: 0.0.0.0 c61c 0c clock_step -913.885823 s

Note that ntpd can change the time and that might change the results of uptime. For some reason mine is reporting 40 minutes less than the true value, even though ntpd could only account for 15 minutes of the difference.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .