Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
No or else I would get it with other things too like my other pc in the living room or my wifes pc. Also alarms clocks would reset etc etc etc. Plus the server is on a power surge adapter block.
OK, just a thought. Now for some more thoughts ...
Anything suspicious in the logs before those times? Any possibility of a tricky program running? All crontab entries kosher (the tricky program could use a random wait or "do nothing")? All init scripts kosher? Can you try leaving it in single user mode (well, ubuntu's approximation)?
Absolutely nothing. I have 3 other entries before the system "went down" and those were shorewall entries letting my living room pc log onto the system when I was awake. After that it was the "ubuntu: restart" line and then pages of system output as if the machine is booting up.
Have browsed my /var/log/messages* files and the message is always the first on boot. Normally the last message before it is "exiting on signal 15" and the timestamp corresponds to it being several hours before when I shut down.
Can we assume that the message indicates a boot on your system? Apart from the Sep 6 06:47:05 one, were they all followed by messages indicating boot? Mine start with "kernel: Inspecting /boot/System.map-2.6.24-24-generic". Once my system has booted there are few messages except "-- MARK --" every 20 minutes and a flurry of messages on loading DVD media until a burst of less than 10 messages before shut down.
If you are not seeing shutdown messages and are seeing syslogd restart messages then it looks like your system is shutting down without warning (power loss?) and automatically restarting (BIOS setting plus power restore?).
I suspect your surge protector is over-sensitive. The only regular shutdowns are around 6:30 which (depending on where you live) could be caused by spikes on the mains when a street light turns off. The variable times could be caused by the cloudiness of the dawn affecting the street light's ambient light sensor.
You could try removing the surge protection.
My theory doesn't jive with "It normally sends me approx 5 emails on the services being [snip] back up"
I don't think there's nothing wrong with that. It's just your system logger (syslogd, system logger daemon) restarting, pure routine.
Most systems nowadays use logrotate to rotate the logs. That tiny tool actually needs to stop the logger for a moment, to close the file descriptors associated to the log files. The files are moved, renamed, compressed and whatever else, and then new descriptors are opened for the next new log file. This can happen at scheduled times, but also based on the size of logs, note that there are quite a few log files under /var/log/ in any normal Linux system, so that's a lot of times each day. Nothing strange in that.
I have highlighted something that might be of interest!?!
I don't think so; my system has it too. I think it just means the boot process checked for a resume image and didn't find one meaning the last shutdown was not a suspend.
Regards i92guboj's "I don't think there's nothing wrong with that. It's just your system logger (syslogd, system logger daemon) restarting, pure routine.", it's possible but I wouldn't expect so many minutes variation and almost all the restart messages are followed by boot messages so it looks like syslogd is starting on boot rather than starting on logrotate activity. On my system there were no logrotate-induced syslogd restarts and each messages file logs several days
But look at those 07:* timestamps. I never start the computer at that time so they are when it has been running all night and being logrotated -- suggests i92guboj is right. No time right now but will investigate later and post back.
Here's the first few lines of my "2009-08-07 07:49 messages.0", when syslogd was restarted by logrotate (it also shows a shutdown and syslogd "restarting" on the next boot
Jul 31 07:45:20 CW8 syslogd 1.5.0#1ubuntu1: restart.
Jul 31 08:08:09 CW8 -- MARK --
Jul 31 08:28:09 CW8 -- MARK --
Jul 31 08:48:09 CW8 -- MARK --
Jul 31 09:08:09 CW8 -- MARK --
Jul 31 09:28:09 CW8 -- MARK --
Jul 31 09:48:09 CW8 -- MARK --
Jul 31 10:08:09 CW8 -- MARK --
Jul 31 10:28:09 CW8 -- MARK --
Jul 31 10:48:09 CW8 -- MARK --
Jul 31 11:08:09 CW8 -- MARK --
Jul 31 11:28:09 CW8 -- MARK --
Jul 31 11:48:09 CW8 -- MARK --
Jul 31 12:08:09 CW8 -- MARK --
Jul 31 12:28:09 CW8 -- MARK --
Jul 31 12:34:35 CW8 kernel: [22336.306699] nfsd: last server has exited
Jul 31 12:34:35 CW8 kernel: [22336.306704] nfsd: unexporting all filesystems
Jul 31 12:34:35 CW8 exiting on signal 15
Jul 31 12:36:50 CW8 syslogd 1.5.0#1ubuntu1: restart.
Jul 31 12:36:50 CW8 kernel: Inspecting /boot/System.map-2.6.24-24-generic
I thought it was a daemon restart but the system boot up sequence in the logs and the uptime kinda gives that away. Specially as I am not awake at midnight rebooting my server (ie 18hrs ago)
Should ask why does my restart log show this times when I am not there to reboot it.
go into bios and set the clock
set time to local local means the bios time.
is my power setting set to a soft shut down after so many hours.
Is power settings set to go to sleep and if so the hard drive stops but the image is left in ram. and will sync with the swap partition for the tmp data left there.
then it will reboot from image. and data file for a soft reboot is not on the swap partition
this seems to me to be either a power setting configuration or the bios clock is not in sync with the time server.
There is no real problem unless some one is logging in as sudo. Ubuntu is real big on setting up power configuration since it is for dell distro's. Most likely the default setting are for the system to power down to suspend to ram. They do this for lap tops. but if you do not configure it to resume or sleep the scripts still run and you get log messages.
The issue is that /var/log/messages shows the same "syslogd 1.5.0#1ubuntu1: restart" message on both boot and restarting syslogd. As I understand fusion1275's posts, the messages in /var/log/messages immediately after "syslogd 1.5.0#1ubuntu1: restart" and the uptime both suggest that most of the "syslogd 1.5.0#1ubuntu1: restart" messages come from boots rather than from syslogd restarts.