one of our virtual servers has been rebooted. the hosting company say they did not do any reboot.

the "last" command show:

reboot   system boot Thu May 12 04:23 - 23:16 (5+18:53)
reboot   system boot Thu May 12 03:34 - 04:05  (00:31)
reboot   system boot Thu May 12 03:15 - 03:23  (00:07)

can i find why it has been rebooted?



Check /var/log/auth.log to see what was happening at the time of the incident. Also try checking /var/log/messages or /var/log/syslog, as these may show that the server's reboot button was pressed.

  • these will show who did it and what they did, but they wont necessarily explain why they did it – anthonysomerset May 17 '11 at 21:46
  • 5
    No, it won't. I'm not aware of any technology that can reliably collect that information. – JamesHannah May 17 '11 at 21:52

The simple answer why is, someone ran the reboot command, I would check who has root access to your server and ask them first, they will likely have a more detailed reason why.

the auth log will only tell you who logged in and what commands they ran, which is difficult to tell who if its the root user and why they ran them. in this situation knowing who had/has access to your server is more important as they will be the quickest way to an actual answer as to why it was rebooted

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.