My ubuntu server (12.04) sometimes restart without notification. How can I check what triggered the server restart?
This is an art.
If you can, enable serial console (you'll need BIOS support, may want to enable GRUB support, and run a TTY), and ensure that syslog and the kernel write to console. A screen session capturing this to a file on another server can be useful.
The usual log suspects:
One of the most useful things to do is to enable
If you're still stumped, start looking at hardware components (memory, CPU, and motherboard components are prime suspects), swapping out / disabling some or all of these, etc. Kernel drivers can cause faults, so loading/unloading modules may reveal things.
BIOS configurations can produce issues. E.g.: Dell had a "CSTATE" settings issue a couple of years ago, Intel had a northgate/southgate configuration issue a ways back. Check with your BIOS/system vendor for any suggested settings or firmware updates.
Over the years, I've had random lockups/crashes due to bad capacitors, bad RAM, BIOS, samba drivers, hardware encryption accelerators, power supply/distribution elements, motherboard wiring, mains power disruptions, and various forms of operator error / intervention. Generally, start with easy/loggable stuff, and start eliminating components (hardware or software) from possible candidates.
It's often very difficult.
Some places to look: