Reboots at 60 minutes

dgermann · 08-09-2008, 07:55 PM

Hi--

What would cause a computer to reboot every 60 minutes?

Here is what last shows:

Code:

doug     pts/0        :0.0             Sat Aug  9 20:40   still logged in   
doug     tty7         :0               Sat Aug  9 20:36   still logged in   
reboot   system boot  2.6.24-19-generi Sat Aug  9 20:35 - 20:45  (00:09)    
doug     pts/0        :0.0             Sat Aug  9 18:11 - crash  (02:24)    
doug     tty7         :0               Sat Aug  9 18:11 - crash  (02:24)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 18:10 - 20:45  (02:34)    
doug     pts/0        :0.0             Sat Aug  9 18:03 - down   (00:05)    
doug     tty7         :0               Sat Aug  9 18:03 - down   (00:05)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 17:23 - 18:08  (00:45)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 16:23 - 18:08  (01:45)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 15:23 - 18:08  (02:45)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 14:22 - 18:08  (03:45)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 13:22 - 18:08  (04:46)    
doug     pts/0        :0.0             Sat Aug  9 12:26 - crash  (00:56)    
doug     tty7         :0               Sat Aug  9 12:25 - crash  (00:56)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 12:25 - 18:08  (05:43)    
doug     pts/0        :0.0             Sat Aug  9 12:17 - 12:19  (00:02)    
doug     tty7         :0               Sat Aug  9 12:16 - 12:19  (00:03)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 11:29 - 12:19  (00:49)    
doug     pts/0        :0.0             Sat Aug  9 10:57 - 11:00  (00:03)    
doug     tty7         :0               Sat Aug  9 10:53 - crash  (00:35)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 10:29 - 12:19  (01:50)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 09:29 - 12:19  (02:50)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 08:28 - 12:19  (03:50)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 07:28 - 12:19  (04:51)    
reboot   system boot  2.6.24-19-generi Sat Aug  9 06:28 - 12:19  (05:51)

(At 12:16 I shut down the computer, unplugging everything from the wall, and then restarted. I noticed that the computer, even after shutdown -h now did not power off--had to pull the plug to do that. Then again at 6:10 pm I went through the same procedure and again at 7:10 pm it shutdown again--not sure why those are not showing on this log.)

I see a couple of these are shown as crash. But not all.

About a week ago I had this problem and unplugging gave me a week without problems. About 4 months ago I had the issue and by accident discovered that the unplugging solved the problem. All problems have occurred on a Saturday, if that is any clue. No, there is nothing in crontab to trigger this.

The system is Ubuntu 8.04.01 on a PC.

I see nothing in bios that would do this, either.

Any ideas where to start looking?

Thanks!

billymayday · 08-09-2008, 08:09 PM

Have you checked all the crontabs? Nothing in atq? No temperature issues? Are you connected to a ups?

dgermann · 08-10-2008, 08:43 AM

billymayday--

Thanks for being so quick in replying!

anacrontab only has run-parts; there is a /usr/bin/crontab:

Code:

doug@doug2:~$ /usr/bin/crontab -l
no crontab for doug
doug@doug2:~$ sudo /usr/bin/crontab -l
[sudo] password for doug: 
7 0 * * * /etc/webmin/cron/tempdelete.pl

This appears to be deleting temporary files created by webmin, and I have not run webmin on this machine in ages. That seems an unlikely source of the problem.

The /etc/crontab is:

Code:

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user	command
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

####copied from sdb1 (old drive) and refers there 20071208: did not work so commented out for now; changed to new locations 20071210:

0 * * * * root /usr/sbin/esets_update

##############ddg 20061113 updated for new directories 20071210:

#0 3 * * * root /usr/sbin/esets_scan -l --mail –unsafe / -- -/dev* -/proc* -/sam* -/media/sdb1/dev* -/media/sdb1/proc* -/media/sdb1/sam*
###20080715 ddg:
#0 3 * * * root /usr/sbin/esets_scan -f /var/log/esets/scan.log / --exclude /dev /proc /sam
0 3 * * * root /etc/cron.doug/eset
#0 21 * * * root /etc/cron.doug/eset
###




30 * * * *      root    cp -pru ~doug/.evolution /sam/vol22/comm/evo/

#######added by ddg 20080115:
21 15 * * *     root     cp -u /sam/vol22/data/ts/TSBACKUP.BKU ~doug
#######end of addition 20080115

###added by ddg 20080120:
31 01 18 1,3,5,7,9,11 * root /etc/cron.doug/bkmonthone
31 01 18 2,4,6,8,,10,12 * root /etc/cron.doug/bkmonthtwo
# 31 01 18 3,6,9,12 * root /etc/cron.doug/bkmonththree
###

atq returns nothing--just another command prompt.

Yes, I am connected to a ups, an APC ES 550, which is about a month old, so the problem spans the time pre and post ups.

One curious thing is that many mornings between 8 and 9 am there is a "power failure" shown on the ups that lasts for a couple of seconds. It is usually reported as something like voltage is out of range. But none of that the last two days.

Not sure how I'd check for temperature issues. This is in an air conditioned office, so the range should not be great. It has been cool the last couple of nights with temps dropping into the 50s F outdoors.

Does any of this suggest other things to check?

Thanks, billymayday!

PS: last this morning shows another 9 reboots.

PTrenholme · 08-10-2008, 10:29 AM

From the log you present, it looks like your problem is on your Ubuntu system. Is it possible that you have the daemon that checks for updates and installs them automatically running? Perhaps it's trying to install something that requires a reboot (There are a few such things.) and the update is failing.

Try running aptitude, look at what seems to be available for updating, and apply each one by hand to see if one forces a reboot.

dgermann · 08-10-2008, 06:52 PM

PTrenholme--

Thanks for jumping in.

Yours is a logical deduction. Unfortunately, I blew the execution of what you suggested.

I do not know anything about aptitude and have never used it before. Don't understand its screens. I ran update manager and even had it check for updates, but it found none. I then ran synaptic and had it check for updates and it did not highlight any.

I then tried sudo aptitude, and it listed a bunch of programs it would delete (all said that they were automatically installed and that the programs which depended upon them had been removed), and I thought I selected one to delete, but it deleted all of them. There was no request for a reboot during the process.

I repeatedly did u and U and get nothing obvious showing up on aptitude.

Then I ran sudo apt-get update and upgrade: It shows nothing to upgrade.

Another clue which I think supports your theory: the last of the reboots happened this morning at 9:14. All of this activity has to my recollection been on Saturdays and Sundays and then it quiets down for the week.

Are there any log files that would say exactly what is going on, what triggered the reboot?

My only clue is I will be sitting here working, and then hear the computer fan start up. Sometimes I have an instant to save my work, but then it reboots.

Strangeness....

billymayday · 08-10-2008, 07:08 PM

Have a look at the mod time of your logs. Something like "ls -lrt /var/log" and see what got updated at or since the offending time.

dgermann · 08-10-2008, 07:56 PM

billymayday--

Thanks for helping!

dmesg.0 was created about that time, but it appears to be just the bootup sequence, so there is no real help there. There is a sequence of these at 8:27, 7:27, 6:27, 5:27, and 4:26.

I have gone through what look to me like the likely clue-holding files and all I am seeing is various logs reporting that there were restarts at the approximate times showing in the "last" results in post 1 above.

Here are the results from the applicable times--perhaps I am missing something. Which ones would you look in and for what (since not all seem to record times)?

Code:

drwxr-x--- 3 root   adm      4096 2008-08-10 00:33 samba
-rw-r----- 1 root   adm      9858 2008-08-10 04:26 dmesg.4.gz
-rw-r----- 1 root   adm      9805 2008-08-10 05:27 dmesg.3.gz
-rw-r----- 1 root   adm      9818 2008-08-10 06:27 dmesg.2.gz
-rw-r----- 1 root   adm      9908 2008-08-10 07:27 dmesg.1.gz
-rw-r----- 1 root   adm     34978 2008-08-10 08:27 dmesg.0
-rw-r--r-- 1 root   root    33252 2008-08-10 08:28 Xorg.0.log.old
-rw-r--r-- 1 root   root     4179 2008-08-10 09:13 apcupsd.events
-rw-r--r-- 1 root   root   359200 2008-08-10 09:14 udev
-rw-r----- 1 root   adm     33956 2008-08-10 09:14 dmesg
-rw-r----- 1 syslog adm      1350 2008-08-10 09:15 user.log
drwxr-xr-x 2 root   root     4096 2008-08-10 09:15 gdm
-rw-r----- 1 root   adm      3742 2008-08-10 09:15 acpid
-rw-r----- 1 syslog adm   1562661 2008-08-10 09:15 kern.log
-rw-r----- 1 syslog adm    290413 2008-08-10 09:15 debug
-rw-r--r-- 1 root   root    33362 2008-08-10 19:13 Xorg.0.log
-rw-r--r-- 1 root   root     1338 2008-08-10 19:40 aptitude
-rw-r----- 1 root   adm   1061357 2008-08-10 19:40 dpkg.log
-rw-r----- 1 syslog adm     45260 2008-08-10 19:47 auth.log
-rw-r----- 1 syslog adm    134259 2008-08-10 20:02 daemon.log
-rw-r----- 1 syslog adm    570980 2008-08-10 20:35 syslog
-rw-r----- 1 syslog adm   1302323 2008-08-10 20:35 messages
-rw-rw-r-- 1 root   utmp   187776 2008-08-10 20:38 wtmp

Thanks folks!

billymayday · 08-10-2008, 08:10 PM

I'd be looking at any log updated at or since the last reboot

Can you post the output of "ls /etc/cron.hourly" and "ls /var/spool/cron"?

dgermann · 08-11-2008, 10:06 AM

billymayday--

OK. So I previously looked at those log files and saw nothing that seemed to relate.

Here is the output of those commands:

Code:

doug@doug2:/etc/cron.hourly$ ls -alh
total 20K
drwxr-xr-x   2 root root 4.0K 2008-08-02 16:37 .
drwxr-xr-x 145 root root  12K 2008-08-11 06:56 ..
-rw-r--r--   1 root root  102 2006-12-20 09:46 .placeholder
doug@doug2:/etc/cron.hourly$ ls -alh /var/spool/cron
total 20K
drwxr-xr-x 5 daemon daemon  4.0K 2007-12-05 21:40 .
drwxr-xr-x 9 root   root    4.0K 2008-08-02 12:33 ..
drwxrwx--T 2 daemon daemon  4.0K 2007-12-05 21:42 atjobs
drwxrwx--T 2 daemon daemon  4.0K 2007-02-20 08:41 atspool
drwx-wx--T 2 root   crontab 4.0K 2008-02-02 13:19 crontabs
doug@doug2:/etc/cron.hourly$ ls -alh /var/spool/cron/atjobs/
ls: cannot open directory /var/spool/cron/atjobs/: Permission denied
doug@doug2:/etc/cron.hourly$ sudo ls -alh /var/spool/cron/atjobs/
[sudo] password for doug: 
total 12K
drwxrwx--T 2 daemon daemon 4.0K 2007-12-05 21:42 .
drwxr-xr-x 5 daemon daemon 4.0K 2007-12-05 21:40 ..
-rw------- 1 daemon daemon    2 2007-12-05 21:42 .SEQ
doug@doug2:/etc/cron.hourly$ sudo ls -alh /var/spool/cron/atspool/
total 8.0K
drwxrwx--T 2 daemon daemon 4.0K 2007-02-20 08:41 .
drwxr-xr-x 5 daemon daemon 4.0K 2007-12-05 21:40 ..
doug@doug2:/etc/cron.hourly$ sudo ls -alh /var/spool/cron/crontabs/
total 12K
drwx-wx--T 2 root   crontab 4.0K 2008-02-02 13:19 .
drwxr-xr-x 5 daemon daemon  4.0K 2007-12-05 21:40 ..
-rw------- 1 root   crontab  242 2008-02-02 13:19 root

sudo less /var/spool/cron/atjobs/.SEQ produces:

Code:

0
/var/spool/cron/atjobs/.SEQ (END)

sudo less /var/spool/cron/crontabs/root produces:

Code:

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.s3CJwX/crontab installed on Sat Feb  2 13:19:24 2008)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
7 0 * * * /etc/webmin/cron/tempdelete.pl
/var/spool/cron/crontabs/root (END)

less /etc/cron.hourly/.placeholder produces:

Code:

# DO NOT EDIT OR REMOVE
# This file is a simple placeholder to keep dpkg from removing this directory
/etc/cron.hourly/.placeholder (END)

So I see no clues in any of this. Do you?

But here is another clue, perhaps: When I manually reboot the machine, the next autoreboot is one hour from the manual reboot. So if it has been auto rebooting at 27 minutes past the hour, and I manually reboot at 14 minutes past, the next auto reboot is at 14 minutes past.

So manually rebooting resets this "clock." What would do that?

Thanks very much for continuing to help me, billymayday!

PTrenholme · 08-11-2008, 10:53 AM

The ./paceholder script, which runs every hour, looks like an infinite recursion. If it is, that would crash almost any system.

I do note that .placeholder is not listed as executable, but it looks, in the listing, like it's being invoked as a program. Frankly, I'm not too clear what the cron process does when the file to which it's pointed is not executable.

Since the file is just a placeholder, perhaps you might remove it for a couple of hours and see what happens. (And if dkpg does remove the directory, so what? You can always recreate it. In fact, as a test, just mv /etc/cron.hourly /etc/cron.hourly~ and wait a couple hours.

dgermann · 08-11-2008, 11:03 AM

PTrenholme--

OIC what you mean by an infinite recursion.

Looks like there are several of these:

Code:

doug@doug2:~$ locate placeholder
/etc/cron.d/.placeholder
/etc/cron.daily/.placeholder
/etc/cron.hourly/.placeholder
/etc/cron.monthly/.placeholder
/etc/cron.weekly/.placeholder
/usr/share/icons/gnome/16x16/stock/image/stock_placeholder-graphic.png
/usr/share/icons/gnome/16x16/stock/image/stock_placeholder-line-contour.png
/usr/share/icons/gnome/16x16/stock/image/stock_placeholder-picture.png
/usr/share/icons/gnome/16x16/stock/image/stock_placeholder-text.png
/usr/share/icons/gnome/24x24/stock/image/stock_placeholder-graphic.png
/usr/share/icons/gnome/24x24/stock/image/stock_placeholder-line-contour.png
/usr/share/icons/gnome/24x24/stock/image/stock_placeholder-picture.png
/usr/share/icons/gnome/24x24/stock/image/stock_placeholder-text.png
/usr/share/nautilus/nautilus-extras.placeholder
/usr/share/nautilus/nautilus-suggested.placeholder
doug@doug2:~$

I'll check this out this evening on at least the cron files. I probably ought to reset the bios and system clocks too, to a Saturday, yes?

Thanks, PTrenholme!

billymayday · 08-11-2008, 04:08 PM

I looked at my Ubuntu setup, and here's what I get:

Quote:

cat /mnt/etc/cron.hourly/.placeholder
# DO NOT EDIT OR REMOVE
# This file is a simple placeholder to keep dpkg from removing this directory

To avoid any confusion, I simply mounted my Ubuntu partition, hence the /mnt

Note that the last line of the OP's entry )/etc/cron.hourly/.placeholder (END)) is simply output from the less command, and is not in the file itself (it, try cat instead of less)

dgermann · 08-11-2008, 05:03 PM

billymayday--

Yes, you are right. What I posted was from less; using cat I get:

Code:

doug@doug2:~$ cat /etc/cron.hourly/.placeholder 
# DO NOT EDIT OR REMOVE
# This file is a simple placeholder to keep dpkg from removing this directory
doug@doug2:~$

So we are back to square one: no real clue in the cron files.

I checked all the cron related .placeholder files and they are all identical to this.

OK, so take a look here:

Code:

ls -alh /etc/cron.weekly/
total 36K
drwxr-xr-x   2 root root 4.0K 2008-08-08 12:36 .
drwxr-xr-x 145 root root  12K 2008-08-11 16:37 ..
-rwxr-xr-x   1 root root  312 2007-03-05 01:38 0anacron
-rwxr-xr-x   1 root root  528 2008-03-12 09:24 man-db
-rw-r--r--   1 root root  102 2006-12-20 09:46 .placeholder
-rwxr-xr-x   1 root root 2.5K 2008-01-28 12:47 popularity-contest
-rwxr-xr-x   1 root root 1.2K 2007-09-17 16:54 sysklogd

I'm curious about that popularity-contest entry, but I found at least one thing on the Web that suggests it is a Debian thing and legit.

So, are we making any progress?

Thanks for all your help, billymayday!

billymayday · 08-11-2008, 05:39 PM

I'm a bit stumped. It's clear that something is firing up after an hour to cause the problem. Sounds like nothing in cron or at, so presumably some other service that sleeps.

I need to fire Ubuntu up, so I'll come back

billymayday · 08-11-2008, 06:19 PM

What is in /etc/anacrontab?