up vote 3 down vote favorite
1
share [g+] share [fb]

Our Linux Server keeps getting the following message every few days. Where would I go to track down this issue?

Broadcast message from root (Mon Mar 1 20:13:57 2010):

The system is going down for system halt NOW!

Edit: /var/log/messages looks like this

Mar 1 18:10:05 CFMC2 sshd(pam_unix)[3326]: session closed for user alberte

Mar 1 20:13:57 CFMC2 shutdown: shutting down for system halt

Mar 1 20:13:57 CFMC2 init: Switching to runlevel: 0

Mar 1 20:13:57 CFMC2 gconfd (cfmc-5252): Received signal 15, shutting down cleanly

Mar 1 20:13:57 CFMC2 gconfd (cfmc-5252): Exiting

I also just foound this after running the command 'last'

reboot system boot 2.6.9-67.0.1.ELs Mon Mar 1 20:41 (15:35)

Thanks, Digital Ninja

link|improve this question
65% accept rate
feedback

4 Answers

up vote 3 down vote

The last time I saw this it turned out to be a bad motherboard sensor. The sensor was convinced the server was overheating and the OS would just shut down.

Check your BIOS or built-in management for hardware event logs that might describe what is happening.

link|improve this answer
2  
Could also be a flaky power switch - I had a server that would power itself down randomly and it turned out to be a power switch that would intermittently close and send the "ACPI power off" signal. Stuff like this usually leaves a helpful log message (at least on FreeBSD, I think Linux does too) – voretaq7♦ Mar 2 '10 at 3:36
feedback
up vote 2 down vote

Dude, someone has put shutdown -h now into crontab.

Check /var/log/cron

link|improve this answer
Check /etc/cron* & crontab -l – dezwart Mar 2 '10 at 3:30
I checked my cron and /var/log/cron and I don't see anything strange. Nothing is even remotely scheduled to happen the same time the server shuts down. Almost always at 7:30 - 8:30 pm cst. – The Digital Ninja Mar 2 '10 at 3:31
Can you post some entries from /var/log/messages ? Also, is there a keyboard on this machine? Could someone be hitting CTL-ATL-DELETE, or possibly something else triggering the reboot ? – Dave Cheney Mar 2 '10 at 3:34
If it's always at the same time +/- a few minutes or so it's something scheduled (cron, something remote, a cleaning lady who bumps the power switch); otherwise see David Mackintosh's answer. – voretaq7♦ Mar 2 '10 at 3:34
feedback
up vote 1 down vote

Is there a UPS attached to the machine? Are you sure it's not telling the machine to shut down because it thinks it's dying?

link|improve this answer
feedback
up vote 0 down vote

Couple things:

  • Who has access to this box? Check to see who logged on during those times and check the shell history files.

  • Have you checked out the log files for anything strange?

  • What do you have running on this box? Anything particular happening when this occurs?

  • Any time similarities to when this happens?

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.