6

Linux server hangs for several times without knowing the exact reason. Which file or log should I look at? The server responds to ping, but I can not ssh to it. And when I plug a monitor into it, it does not have any response. Any idea?

2
  • Start with the contents of /var/log.
    – user9517
    Aug 22, 2014 at 6:25
  • 1
    Sometimes you see such symptoms if the system is running low on RAM. If you are lucky, the system managed to log something in /var/log, that will tell you, if it is running low on RAM.
    – kasperd
    Aug 22, 2014 at 7:57

1 Answer 1

7

Kernel hangs are difficult to debug as no oops message is displayed on screen as in case of crash and if you are really lucky you will see something in /var/log/messages as during hang your entire system hangs along with syslog daemon and nothing will be write inside these files.

With that said hangs can be as simple as temporary performance issue caused due to memory or cpu contention,using inefficient algorithm or may be as complicated as deadlock.So like I mentioned above if you are really lucky

1: Check in /var/log/messages or may be run dmesg to get some pointer 2: If your system is hanging on regular basis then configure kdump along with sysrq keys to know the exact problem.

For more info please refer to http://people.redhat.com/anderson/crash_whitepaper/

9
  • i checked the /var/log/messages,it did not log anything during the period when it hangs.
    – snow8261
    Aug 22, 2014 at 6:49
  • 1
    Not all Linux variants use /var/log/messages.
    – user9517
    Aug 22, 2014 at 6:52
  • Yes as I mentioned above that is expected,the other thing you can check if you have sysstat package installed is /var/log/sa/sa<today date file> and see if there is any performance issue during that period.I really doubt about this too as I believe system is not logging for sar also whenever system hang happens.If you still not able to find something in it best way is to configure kdump along with sysrq and replicate the issue. Aug 22, 2014 at 6:53
  • there is no sa<today date file>,just yesterday's.
    – snow8261
    Aug 22, 2014 at 7:11
  • May be I over complicate the stuff but it should be like this -rw-r--r-- 1 root root 251376 Aug 21 23:50 sa21 -rw-r--r-- 1 root root 275239 Aug 21 23:53 sar21 -rw-r--r-- 1 root root 45584 Aug 22 04:10 sa22 so to read today file run sar -A -f sa22 >> /tmp/sarlog and then check to see if you see any performance issue during the time of issue like load average,memory utilization,iowait,user space vs kernel space utilization,for more info you can refer thegeekstuff.com/2011/03/sar-examples Aug 22, 2014 at 8:12

Not the answer you're looking for? Browse other questions tagged .