Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

one of our virtual servers has been rebooted. the hosting company say they did not do any reboot.

the "last" command show:

reboot   system boot Thu May 12 04:23 - 23:16 (5+18:53)
reboot   system boot Thu May 12 03:34 - 04:05  (00:31)
reboot   system boot Thu May 12 03:15 - 03:23  (00:07)

can i find why it has been rebooted?


share|improve this question
up vote 5 down vote accepted

Check /var/log/auth.log to see what was happening at the time of the incident. Also try checking /var/log/messages or /var/log/syslog, as these may show that the server's reboot button was pressed.

share|improve this answer
these will show who did it and what they did, but they wont necessarily explain why they did it – anthonysomerset May 17 '11 at 21:46
No, it won't. I'm not aware of any technology that can reliably collect that information. – JamesHannah May 17 '11 at 21:52

The simple answer why is, someone ran the reboot command, I would check who has root access to your server and ask them first, they will likely have a more detailed reason why.

the auth log will only tell you who logged in and what commands they ran, which is difficult to tell who if its the root user and why they ran them. in this situation knowing who had/has access to your server is more important as they will be the quickest way to an actual answer as to why it was rebooted

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.