I have a webserver I think rebooted at some point .. mostly because apache wasn't serving sites and it usually does that when someone starts it and doesn't enter the SSL cert's password ... and a reboot/start fixed the problem. Looking around in
/var/log/messages, the very first log entries today are:
Jun 30 05:17:40 localhost kernel: imklog 4.2.0, log source = /proc/kmsg started. Jun 30 05:17:40 localhost rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="393" x-info="http://www.rsyslog.com"] (re)start Jun 30 05:17:40 localhost rsyslogd: rsyslogd's groupid changed to 103 Jun 30 05:17:40 localhost rsyslogd: rsyslogd's userid changed to 101
I'm assuming that means it was a reboot, but I know so little about real server administration, I wanted to verify this. I can post the rest of
messages if it would be helpful. The entry prior to these, was the following once per day:
Jun 29 06:34:11 localhost rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="350" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
So do these indicate a server reboot as I am guessing? Is there any way to determine what caused the reboot? Or if a person did it?