-1

I have the linux centos 7 server in datacenter. Server suddently rebooted but we didn't restart the server and datacenter people also claim that he didn't reboot the server.

Now I want to know how server suddently restared ??

Is anybody run linux command reboot via command prompt or anybody have have directly press the reboot switch in datacenter.

I checked /var/log/message but not able to conculed anything.

Please guid how I can identified via log that its hard booted or via command ???

1 Answer 1

0

Check out the output from the last command to make sure it was not rebooted by one of your users/admins it will also give you precise time of the boot.

Here is quick oneliner that will list the last 100 prior the boot event:

BOOT_DATE=$(last | grep boot | head -1 | awk '{print $6, $7}') ; last | grep "$BOOT_DATE" | grep -A 100 "boot"

Output:

reboot   system boot  3.10.0-693.21.1. Wed Mar 21 13:54 - 15:23 (9+00:28)
root     pts/0        <HIDDEN>  Wed Mar 21 13:53 - 13:54  (00:00)
reboot   system boot  3.10.0-693.21.1. Wed Mar 21 13:51 - 13:54  (00:02)
root     pts/0        <HIDDEN>  Wed Mar 21 13:50 - 13:50  (00:00)
reboot   system boot  3.10.0-693.21.1. Wed Mar 21 13:45 - 13:51  (00:05)
root     pts/0        <HIDDEN>  Wed Mar 21 13:43 - 13:44  (00:00)

Having the exact time, search in messages for any events before that time.

If you suspect that the system was rebooted by button press, edit /etc/sysconfig/acpid and put the following:

OPTIONS="-l"

That will make acpid log button presses before shutting down/rebooting the system. Unfortunately it is not enabled by default so you will no see those events for your current incident.

Lastly, if the system lost power/the cable was yanked off, there is no way to know that within the system.

1
  • Hi Thanks for your guidance. this is the automatic reboot log that I get from the last -x command . can we get any information from the below log runlevel (to lvl 3) 3.10.0-693.11.1. Tue Mar 27 15:49 - 14:31 (22:41) reboot system boot 3.10.0-693.11.1. Tue Mar 27 15:49 - 20:35 (2+04:46) runlevel (to lvl 3) 3.10.0-693.11.1. Tue Mar 27 15:47 - 15:49 (00:02) reboot system boot 3.10.0-693.11.1. Tue Mar 27 15:46 - 20:35 (2+04:48)
    – niraj vara
    Mar 31, 2018 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.