Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Please can you clear something up here. I have been getting this in my logs for sometime now and have only just noticed it as it happens early in the morning.
Can you tell me if it is my system bouncing itself or syslogd restarting.. im thinking its the system but im hoping im wrong.
The top one from Sep 6 didnt have anything after it in the logs apart from shorewall outputs during that day around lunchtime. And those were from me logging in remotely.
The Sep 7 however had a full boot output after it from the kernel.
uptime states 17:52 which is the time I am posting this. So I am now assuming the system did reboot at midnight.
Looking at previous logs now I am getting all sorts of things:
I thought it was a daemon restart but the system boot up sequence in the logs and the uptime kinda gives that away. Specially as I am not awake at midnight rebooting my server (ie 18hrs ago)
No or else I would get it with other things too like my other pc in the living room or my wifes pc. Also alarms clocks would reset etc etc etc. Plus the server is on a power surge adapter block.
No or else I would get it with other things too like my other pc in the living room or my wifes pc. Also alarms clocks would reset etc etc etc. Plus the server is on a power surge adapter block.
OK, just a thought. Now for some more thoughts ...
Anything suspicious in the logs before those times? Any possibility of a tricky program running? All crontab entries kosher (the tricky program could use a random wait or "do nothing")? All init scripts kosher? Can you try leaving it in single user mode (well, ubuntu's approximation)?
Absolutely nothing. I have 3 other entries before the system "went down" and those were shorewall entries letting my living room pc log onto the system when I was awake. After that it was the "ubuntu: restart" line and then pages of system output as if the machine is booting up.
Another thing I have noticed is that I didnt get a system generated email from webmin. It normally sends me approx 5 emails on the services being down or back up.
Have browsed my /var/log/messages* files and the message is always the first on boot. Normally the last message before it is "exiting on signal 15" and the timestamp corresponds to it being several hours before when I shut down.
Can we assume that the message indicates a boot on your system? Apart from the Sep 6 06:47:05 one, were they all followed by messages indicating boot? Mine start with "kernel: Inspecting /boot/System.map-2.6.24-24-generic". Once my system has booted there are few messages except "-- MARK --" every 20 minutes and a flurry of messages on loading DVD media until a burst of less than 10 messages before shut down.
If you are not seeing shutdown messages and are seeing syslogd restart messages then it looks like your system is shutting down without warning (power loss?) and automatically restarting (BIOS setting plus power restore?).
I suspect your surge protector is over-sensitive. The only regular shutdowns are around 6:30 which (depending on where you live) could be caused by spikes on the mains when a street light turns off. The variable times could be caused by the cloudiness of the dawn affecting the street light's ambient light sensor.
You could try removing the surge protection.
EDIT:
My theory doesn't jive with "It normally sends me approx 5 emails on the services being [snip] back up"
I don't think there's nothing wrong with that. It's just your system logger (syslogd, system logger daemon) restarting, pure routine.
Most systems nowadays use logrotate to rotate the logs. That tiny tool actually needs to stop the logger for a moment, to close the file descriptors associated to the log files. The files are moved, renamed, compressed and whatever else, and then new descriptors are opened for the next new log file. This can happen at scheduled times, but also based on the size of logs, note that there are quite a few log files under /var/log/ in any normal Linux system, so that's a lot of times each day. Nothing strange in that.
I have highlighted something that might be of interest!?!
I don't think so; my system has it too. I think it just means the boot process checked for a resume image and didn't find one meaning the last shutdown was not a suspend.
Regards i92guboj's "I don't think there's nothing wrong with that. It's just your system logger (syslogd, system logger daemon) restarting, pure routine.", it's possible but I wouldn't expect so many minutes variation and almost all the restart messages are followed by boot messages so it looks like syslogd is starting on boot rather than starting on logrotate activity. On my system there were no logrotate-induced syslogd restarts and each messages file logs several days
EDIT:
But look at those 07:* timestamps. I never start the computer at that time so they are when it has been running all night and being logrotated -- suggests i92guboj is right. No time right now but will investigate later and post back.
EDIT 2:
Here's the first few lines of my "2009-08-07 07:49 messages.0", when syslogd was restarted by logrotate (it also shows a shutdown and syslogd "restarting" on the next boot
Code:
Jul 31 07:45:20 CW8 syslogd 1.5.0#1ubuntu1: restart.
Jul 31 08:08:09 CW8 -- MARK --
Jul 31 08:28:09 CW8 -- MARK --
Jul 31 08:48:09 CW8 -- MARK --
Jul 31 09:08:09 CW8 -- MARK --
Jul 31 09:28:09 CW8 -- MARK --
Jul 31 09:48:09 CW8 -- MARK --
Jul 31 10:08:09 CW8 -- MARK --
Jul 31 10:28:09 CW8 -- MARK --
Jul 31 10:48:09 CW8 -- MARK --
Jul 31 11:08:09 CW8 -- MARK --
Jul 31 11:28:09 CW8 -- MARK --
Jul 31 11:48:09 CW8 -- MARK --
Jul 31 12:08:09 CW8 -- MARK --
Jul 31 12:28:09 CW8 -- MARK --
Jul 31 12:34:35 CW8 kernel: [22336.306699] nfsd: last server has exited
Jul 31 12:34:35 CW8 kernel: [22336.306704] nfsd: unexporting all filesystems
Jul 31 12:34:35 CW8 exiting on signal 15
Jul 31 12:36:50 CW8 syslogd 1.5.0#1ubuntu1: restart.
Jul 31 12:36:50 CW8 kernel: Inspecting /boot/System.map-2.6.24-24-generic
I thought it was a daemon restart but the system boot up sequence in the logs and the uptime kinda gives that away. Specially as I am not awake at midnight rebooting my server (ie 18hrs ago)
Should ask why does my restart log show this times when I am not there to reboot it.
Quote:
go into bios and set the clock
set time to local local means the bios time.
Quote:
is my power setting set to a soft shut down after so many hours.
Is power settings set to go to sleep and if so the hard drive stops but the image is left in ram. and will sync with the swap partition for the tmp data left there.
then it will reboot from image. and data file for a soft reboot is not on the swap partition
this seems to me to be either a power setting configuration or the bios clock is not in sync with the time server.
There is no real problem unless some one is logging in as sudo. Ubuntu is real big on setting up power configuration since it is for dell distro's. Most likely the default setting are for the system to power down to suspend to ram. They do this for lap tops. but if you do not configure it to resume or sleep the scripts still run and you get log messages.
Good luck.
Should ask why does my restart log show this times when I am not there to reboot it.
I haven't seen *your* logs, but the logs shown in this thread are about *syslog* restarting, and not about the whole system restarting, as I already said in my previous post.
It's the system logger restarting, not your box rebooting, which is quite a different thing. I already explained why the logger restarts every now and then in the other post as well.
Maybe I am missing something, but I fail to see a problem in the whole thread.
The few lines of log you quoted on the previous post are from your kernel, and have nothing to do with the original purpose of this thread.
The issue is that /var/log/messages shows the same "syslogd 1.5.0#1ubuntu1: restart" message on both boot and restarting syslogd. As I understand fusion1275's posts, the messages in /var/log/messages immediately after "syslogd 1.5.0#1ubuntu1: restart" and the uptime both suggest that most of the "syslogd 1.5.0#1ubuntu1: restart" messages come from boots rather than from syslogd restarts.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
