Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our Linux Server keeps getting the following message every few days. Where would I go to track down this issue?

Broadcast message from root (Mon Mar 1 20:13:57 2010):

The system is going down for system halt NOW!

Edit: /var/log/messages looks like this

Mar 1 18:10:05 CFMC2 sshd(pam_unix)[3326]: session closed for user alberte

Mar 1 20:13:57 CFMC2 shutdown: shutting down for system halt

Mar 1 20:13:57 CFMC2 init: Switching to runlevel: 0

Mar 1 20:13:57 CFMC2 gconfd (cfmc-5252): Received signal 15, shutting down cleanly

Mar 1 20:13:57 CFMC2 gconfd (cfmc-5252): Exiting

I also just foound this after running the command 'last'

reboot system boot 2.6.9-67.0.1.ELs Mon Mar 1 20:41 (15:35)

Thanks, Digital Ninja

share|improve this question

4 Answers 4

up vote 3 down vote accepted

The last time I saw this it turned out to be a bad motherboard sensor. The sensor was convinced the server was overheating and the OS would just shut down.

Check your BIOS or built-in management for hardware event logs that might describe what is happening.

share|improve this answer
2  
Could also be a flaky power switch - I had a server that would power itself down randomly and it turned out to be a power switch that would intermittently close and send the "ACPI power off" signal. Stuff like this usually leaves a helpful log message (at least on FreeBSD, I think Linux does too) –  voretaq7 Mar 2 '10 at 3:36

Dude, someone has put shutdown -h now into crontab.

Check /var/log/cron

share|improve this answer
    
Check /etc/cron* & crontab -l –  dezwart Mar 2 '10 at 3:30
    
I checked my cron and /var/log/cron and I don't see anything strange. Nothing is even remotely scheduled to happen the same time the server shuts down. Almost always at 7:30 - 8:30 pm cst. –  The Digital Ninja Mar 2 '10 at 3:31
    
Can you post some entries from /var/log/messages ? Also, is there a keyboard on this machine? Could someone be hitting CTL-ATL-DELETE, or possibly something else triggering the reboot ? –  Dave Cheney Mar 2 '10 at 3:34
    
If it's always at the same time +/- a few minutes or so it's something scheduled (cron, something remote, a cleaning lady who bumps the power switch); otherwise see David Mackintosh's answer. –  voretaq7 Mar 2 '10 at 3:34

Is there a UPS attached to the machine? Are you sure it's not telling the machine to shut down because it thinks it's dying?

share|improve this answer

Couple things:

  • Who has access to this box? Check to see who logged on during those times and check the shell history files.

  • Have you checked out the log files for anything strange?

  • What do you have running on this box? Anything particular happening when this occurs?

  • Any time similarities to when this happens?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.