2

One of our servers rebooted last night

reboot   system boot  2.6.32-5-amd64   Wed Jan 15 03:24 - 16:07 (1+12:42)

Our hoster didn't do it, nor did I.

syslog does not show any error

Jan 15 03:17:01 big /USR/SBIN/CRON[840]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly >> /dev/null)
Jan 15 03:20:01 big /USR/SBIN/CRON[844]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Jan 15 03:24:44 big kernel: imklog 4.6.4, log source = /proc/kmsg started.
Jan 15 03:24:44 big rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="893" x-info="http://www.rsyslog.com"] (re)start
Jan 15 03:24:44 big kernel: [    0.000000] Initializing cgroup subsys cpuset
Jan 15 03:24:44 big kernel: [    0.000000] Initializing cgroup subsys cpu
Jan 15 03:24:44 big kernel: [    0.000000] Linux version 2.6.32-5-amd64 (Debian 2.6.32-48squeeze4) (dannf@debian.org) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 SMP Mon Sep 23 22:14:43 UTC 2013
Jan 15 03:24:44 big kernel: [    0.000000] Command line: root=/dev/md1 ro acpi=ht
Jan 15 03:24:44 big kernel: [    0.000000] KERNEL supported cpus:

auth.log does not show anything in a wide timeframe arround 03:24.

lastlog does not show any connectings besides myself.

faillog has no entries.

uprecords

big:/var/log# uprecords
     #               Uptime | System                                     Boot up
----------------------------+---------------------------------------------------
     1   210 days, 06:33:18 | Linux 2.6.32-5-amd64      Wed Mar 13 09:49:06 2013
     2    97 days, 10:58:48 | Linux 2.6.32-5-amd64      Wed Oct  9 17:23:44 2013
->   3     1 day , 12:54:06 | Linux 2.6.32-5-amd64      Wed Jan 15 03:23:22 2014

I can see log entries for what happened after the reboot, but I cannot find ANY information for what caused the reboot.

The CPU usage was very low during the time so it is surely not a overheating problem.

03:10:01 PM     all      0.01      0.00      0.00      0.00      0.00     99.99
03:15:01 PM     all      0.02      0.00      0.00      0.00      0.00     99.97
03:20:01 PM     all      0.01      0.00      0.00      0.00      0.00     99.99
03:25:01 PM     all      0.02      0.00      0.00      0.00      0.00     99.97
03:30:01 PM     all      0.01      0.00      0.00      0.00      0.00     99.99
03:35:01 PM     all      0.01      0.00      0.00      0.00      0.00     99.99
03:40:01 PM     all      0.02      0.00      0.01      0.00      0.00     99.97

Does anyone have an idea where I can go on with the search ?

6
  • 3
    No possibility of a power cut? – NickW Jan 16 '14 at 15:35
  • It is a physical server, right; not something virtualised? – MadHatter Jan 16 '14 at 15:42
  • @MadHatter Yes, physical. – Daniel W. Jan 16 '14 at 15:48
  • 1
    Then I'm with Nick, unexpected failure of the infrastructure would be my first guess. It can also be worth getting the server to syslog to a remote host; kernel panics that won't get written to on-system logs (because of the risk of FS corruption) can still get sent over the UDP service to a remote log host, and recovered there. – MadHatter Jan 16 '14 at 15:50
  • 1
    That doesn't stop it panicking - nothing can stop that, if the kernel gets itself into a bad place! All that does is set the delay in seconds before it reboots; I'm guessing 0 means don't wait, not don't reboot, and that just means there won't be any helpful messages left on the screen (as the reboot will clear them away). That's what the syslogging is to help with. – MadHatter Jan 16 '14 at 16:20
2

My random guess would be power failure, or components failure.

If its not a virtual environment, look into your ILO/DRAC/BIOS to get more log.

2
  • The hoster said they did not reboot the server but I will bother them to have a deeper look, because they have ILO access, I don't have it. – Daniel W. Jan 16 '14 at 15:53
  • The server above mine has had electrical problems which also affected my server :D – Daniel W. Apr 18 '16 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.