LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 09-07-2009, 01:01 PM   #1
fusion1275
Member
 
Registered: Jul 2007
Location: Portsmouth, Hants
Distribution: Linux Mint
Posts: 266

Rep: Reputation: 35
System or Software rebooting?


Hi all,

Please can you clear something up here. I have been getting this in my logs for sometime now and have only just noticed it as it happens early in the morning.

Can you tell me if it is my system bouncing itself or syslogd restarting.. im thinking its the system but im hoping im wrong.

Quote:
Sep 6 06:47:05 Server1 syslogd 1.5.0#1ubuntu1: restart.
Sep 7 00:01:34 Server1 syslogd 1.5.0#1ubuntu1: restart.
The top one from Sep 6 didnt have anything after it in the logs apart from shorewall outputs during that day around lunchtime. And those were from me logging in remotely.

The Sep 7 however had a full boot output after it from the kernel.

uptime states 17:52 which is the time I am posting this. So I am now assuming the system did reboot at midnight.

Looking at previous logs now I am getting all sorts of things:

Quote:
/var/log# ll messages*
-rw-r----- 1 syslog adm 419013 2009-08-30 02:34 messages.1
-rw-r----- 1 syslog adm 69479 2009-09-06 06:42 messages.0
-rw-r----- 1 syslog adm 37190 2009-09-07 17:34 messages

/var/log# grep "ubuntu1: restart" messages*
messages.1:Aug 23 06:47:11 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 24 06:53:42 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 24 09:01:32 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 25 01:05:59 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 25 06:30:23 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 26 06:39:49 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 26 15:23:30 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 26 16:53:38 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 27 06:46:48 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 28 06:46:43 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.1:Aug 29 06:34:22 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Aug 30 06:47:11 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Aug 31 06:55:42 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 1 06:48:45 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 2 06:26:37 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 3 06:25:49 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 4 06:46:46 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 4 23:24:25 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 4 23:41:24 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 5 06:43:15 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages.0:Sep 6 06:42:38 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages:Sep 6 06:47:05 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages:Sep 7 00:01:34 Server1 syslogd 1.5.0#1ubuntu1: restart.
messages:Sep 7 06:45:01 Server1 syslogd 1.5.0#1ubuntu1: restart.
Seems to be a pattern emerging from all of that.

Any clues people?
 
Old 09-07-2009, 01:04 PM   #2
Drakeo
Senior Member
 
Registered: Jan 2008
Location: Urbana IL
Distribution: Slackware, Slacko,
Posts: 3,072
Blog Entries: 3

Rep: Reputation: 323Reputation: 323Reputation: 323Reputation: 323
That is the system log. Ububtu when you do a restart reboot it logs it nothing big
 
Old 09-07-2009, 02:48 PM   #3
fusion1275
Member
 
Registered: Jul 2007
Location: Portsmouth, Hants
Distribution: Linux Mint
Posts: 266

Original Poster
Rep: Reputation: 35
I thought it was a daemon restart but the system boot up sequence in the logs and the uptime kinda gives that away. Specially as I am not awake at midnight rebooting my server (ie 18hrs ago)

Still looking for answers here
 
Old 09-07-2009, 03:16 PM   #4
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
Any possibility that it is caused by mains electrical power fluctuations? Are there any big street lights switching on or off around those times?
 
Old 09-07-2009, 03:19 PM   #5
fusion1275
Member
 
Registered: Jul 2007
Location: Portsmouth, Hants
Distribution: Linux Mint
Posts: 266

Original Poster
Rep: Reputation: 35
No or else I would get it with other things too like my other pc in the living room or my wifes pc. Also alarms clocks would reset etc etc etc. Plus the server is on a power surge adapter block.
 
Old 09-07-2009, 03:31 PM   #6
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
Quote:
Originally Posted by fusion1275 View Post
No or else I would get it with other things too like my other pc in the living room or my wifes pc. Also alarms clocks would reset etc etc etc. Plus the server is on a power surge adapter block.
OK, just a thought. Now for some more thoughts ...

Anything suspicious in the logs before those times? Any possibility of a tricky program running? All crontab entries kosher (the tricky program could use a random wait or "do nothing")? All init scripts kosher? Can you try leaving it in single user mode (well, ubuntu's approximation)?
 
Old 09-07-2009, 03:53 PM   #7
fusion1275
Member
 
Registered: Jul 2007
Location: Portsmouth, Hants
Distribution: Linux Mint
Posts: 266

Original Poster
Rep: Reputation: 35
Absolutely nothing. I have 3 other entries before the system "went down" and those were shorewall entries letting my living room pc log onto the system when I was awake. After that it was the "ubuntu: restart" line and then pages of system output as if the machine is booting up.

Bios outputs
DMA outputs
ACPI outputs
CPU outputs
Memory outputs
raid outputs

and so on...
 
Old 09-07-2009, 03:56 PM   #8
fusion1275
Member
 
Registered: Jul 2007
Location: Portsmouth, Hants
Distribution: Linux Mint
Posts: 266

Original Poster
Rep: Reputation: 35
Another thing I have noticed is that I didnt get a system generated email from webmin. It normally sends me approx 5 emails on the services being down or back up.

Didnt get anything.
 
Old 09-07-2009, 04:32 PM   #9
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
Have browsed my /var/log/messages* files and the message is always the first on boot. Normally the last message before it is "exiting on signal 15" and the timestamp corresponds to it being several hours before when I shut down.

Can we assume that the message indicates a boot on your system? Apart from the Sep 6 06:47:05 one, were they all followed by messages indicating boot? Mine start with "kernel: Inspecting /boot/System.map-2.6.24-24-generic". Once my system has booted there are few messages except "-- MARK --" every 20 minutes and a flurry of messages on loading DVD media until a burst of less than 10 messages before shut down.

If you are not seeing shutdown messages and are seeing syslogd restart messages then it looks like your system is shutting down without warning (power loss?) and automatically restarting (BIOS setting plus power restore?).

I suspect your surge protector is over-sensitive. The only regular shutdowns are around 6:30 which (depending on where you live) could be caused by spikes on the mains when a street light turns off. The variable times could be caused by the cloudiness of the dawn affecting the street light's ambient light sensor.

You could try removing the surge protection.

EDIT:

My theory doesn't jive with "It normally sends me approx 5 emails on the services being [snip] back up"

Last edited by catkin; 09-07-2009 at 04:33 PM.
 
Old 09-07-2009, 05:00 PM   #10
i92guboj
Gentoo support team
 
Registered: May 2008
Location: Lucena, Córdoba (Spain)
Distribution: Gentoo
Posts: 4,063

Rep: Reputation: 381Reputation: 381Reputation: 381Reputation: 381
I don't think there's nothing wrong with that. It's just your system logger (syslogd, system logger daemon) restarting, pure routine.

Most systems nowadays use logrotate to rotate the logs. That tiny tool actually needs to stop the logger for a moment, to close the file descriptors associated to the log files. The files are moved, renamed, compressed and whatever else, and then new descriptors are opened for the next new log file. This can happen at scheduled times, but also based on the size of logs, note that there are quite a few log files under /var/log/ in any normal Linux system, so that's a lot of times each day. Nothing strange in that.

Last edited by i92guboj; 09-07-2009 at 05:03 PM.
 
Old 09-07-2009, 06:22 PM   #11
fusion1275
Member
 
Registered: Jul 2007
Location: Portsmouth, Hants
Distribution: Linux Mint
Posts: 266

Original Poster
Rep: Reputation: 35
Just found this is a file called "debug"

Quote:
Sep 7 00:01:35 Sapphire-home kernel: [ 25.868583] CPU: After all inits, caps: 0383f9ff c1c3f9ff 00000000 00000420 00000000 00000000 00000000 00000000
Sep 7 00:01:35 Sapphire-home kernel: [ 26.430477] CPU0 attaching sched-domain:
Sep 7 00:01:35 Sapphire-home kernel: [ 26.430482] domain 0: span 01
Sep 7 00:01:35 Sapphire-home kernel: [ 26.430485] groups: 01
Sep 7 00:01:35 Sapphire-home kernel: [ 26.471703] ACPI: EC: Look up EC in DSDT
Sep 7 00:01:35 Sapphire-home kernel: [ 26.480713] ACPI: PCI Interrupt Routing Table [\_SB_.PCI0._PRT]
Sep 7 00:01:35 Sapphire-home kernel: [ 27.651356] Boot video device is 0000:01:05.0
Sep 7 00:01:35 Sapphire-home kernel: [ 30.016216] PCI: setting IRQ 10 as level-triggered
Sep 7 00:01:35 Sapphire-home kernel: [ 30.028633] libata version 3.00 loaded.
Sep 7 00:01:35 Sapphire-home kernel: [ 30.096142] PCI: setting IRQ 11 as level-triggered
Sep 7 00:01:35 Sapphire-home kernel: [ 30.223510] Probing IDE interface ide2...
Sep 7 00:01:35 Sapphire-home kernel: [ 30.958257] hde: host max PIO4 wanted PIO255(auto-tune) selected PIO4
Sep 7 00:01:35 Sapphire-home kernel: [ 30.959134] Probing IDE interface ide3...
Sep 7 00:01:35 Sapphire-home kernel: [ 31.581969] hdg: host max PIO4 wanted PIO255(auto-tune) selected PIO4
Sep 7 00:01:35 Sapphire-home kernel: [ 31.790146] pata_via 0000:00:07.1: version 0.3.3
Sep 7 00:01:35 Sapphire-home kernel: [ 32.196553] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
Sep 7 00:01:35 Sapphire-home kernel: [ 32.196689] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
Sep 7 00:01:35 Sapphire-home kernel: [ 33.738862] swsusp: Resume From Partition 254:4
Sep 7 00:01:35 Sapphire-home kernel: [ 33.738865] PM: Checking swsusp image.
Sep 7 00:01:35 Sapphire-home kernel: [ 33.756372] PM: Resume from disk failed.
Sep 7 00:01:35 Sapphire-home kernel: [ 36.113509] ext3_orphan_cleanup: deleting unreferenced inode 81781
Sep 7 00:01:35 Sapphire-home kernel: [ 36.123377] ext3_orphan_cleanup: deleting unreferenced inode 81784
Sep 7 00:01:35 Sapphire-home kernel: [ 36.138964] ext3_orphan_cleanup: deleting unreferenced inode 46058
Sep 7 00:01:35 Sapphire-home kernel: [ 57.780558] parport_pc: VIA 686A/8231 detected
Sep 7 00:01:35 Sapphire-home kernel: [ 57.780565] parport_pc: probing current configuration
Sep 7 00:01:35 Sapphire-home kernel: [ 57.780585] parport_pc: Current parallel port base: 0x378
Sep 7 00:01:35 Sapphire-home kernel: [ 73.104461] eth0: no IPv6 routers present
I have highlighted something that might be of interest!?!
 
Old 09-08-2009, 04:41 AM   #12
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
Quote:
Originally Posted by fusion1275 View Post
Just found this is a file called "debug"

I have highlighted something that might be of interest!?!
I don't think so; my system has it too. I think it just means the boot process checked for a resume image and didn't find one meaning the last shutdown was not a suspend.

Regards i92guboj's "I don't think there's nothing wrong with that. It's just your system logger (syslogd, system logger daemon) restarting, pure routine.", it's possible but I wouldn't expect so many minutes variation and almost all the restart messages are followed by boot messages so it looks like syslogd is starting on boot rather than starting on logrotate activity. On my system there were no logrotate-induced syslogd restarts and each messages file logs several days
Code:
root@CW8:/var/log# /bin/ls -lrt messages*
-rw-r----- 1 syslog adm   47539 2008-07-07 07:13 messages.6.gz
-rw-r----- 1 syslog adm  188297 2008-08-18 08:41 messages.5.gz
-rw-r----- 1 syslog adm  169220 2009-05-15 10:41 messages.4.gz
-rw-r----- 1 syslog adm   92361 2009-07-17 02:18 messages.3.gz
-rw-r----- 1 syslog adm  110269 2009-07-24 08:04 messages.2.gz
-rw-r----- 1 syslog adm  101366 2009-07-31 07:45 messages.1.gz
-rw-r----- 1 syslog adm  470078 2009-08-07 07:49 messages.0
-rw-r----- 1 syslog adm 5825483 2009-09-08 13:51 messages
EDIT:
But look at those 07:* timestamps. I never start the computer at that time so they are when it has been running all night and being logrotated -- suggests i92guboj is right. No time right now but will investigate later and post back.

EDIT 2:
Here's the first few lines of my "2009-08-07 07:49 messages.0", when syslogd was restarted by logrotate (it also shows a shutdown and syslogd "restarting" on the next boot
Code:
Jul 31 07:45:20 CW8 syslogd 1.5.0#1ubuntu1: restart.
Jul 31 08:08:09 CW8 -- MARK --
Jul 31 08:28:09 CW8 -- MARK --
Jul 31 08:48:09 CW8 -- MARK --
Jul 31 09:08:09 CW8 -- MARK --
Jul 31 09:28:09 CW8 -- MARK --
Jul 31 09:48:09 CW8 -- MARK --
Jul 31 10:08:09 CW8 -- MARK --
Jul 31 10:28:09 CW8 -- MARK --
Jul 31 10:48:09 CW8 -- MARK --
Jul 31 11:08:09 CW8 -- MARK --
Jul 31 11:28:09 CW8 -- MARK --
Jul 31 11:48:09 CW8 -- MARK --
Jul 31 12:08:09 CW8 -- MARK --
Jul 31 12:28:09 CW8 -- MARK --
Jul 31 12:34:35 CW8 kernel: [22336.306699] nfsd: last server has exited
Jul 31 12:34:35 CW8 kernel: [22336.306704] nfsd: unexporting all filesystems
Jul 31 12:34:35 CW8 exiting on signal 15
Jul 31 12:36:50 CW8 syslogd 1.5.0#1ubuntu1: restart.
Jul 31 12:36:50 CW8 kernel: Inspecting /boot/System.map-2.6.24-24-generic

Last edited by catkin; 09-08-2009 at 07:30 AM.
 
Old 09-08-2009, 09:53 AM   #13
Drakeo
Senior Member
 
Registered: Jan 2008
Location: Urbana IL
Distribution: Slackware, Slacko,
Posts: 3,072
Blog Entries: 3

Rep: Reputation: 323Reputation: 323Reputation: 323Reputation: 323
Quote:
I thought it was a daemon restart but the system boot up sequence in the logs and the uptime kinda gives that away. Specially as I am not awake at midnight rebooting my server (ie 18hrs ago)
Should ask why does my restart log show this times when I am not there to reboot it.
Quote:
go into bios and set the clock
set time to local local means the bios time.
Quote:
is my power setting set to a soft shut down after so many hours.
Is power settings set to go to sleep and if so the hard drive stops but the image is left in ram. and will sync with the swap partition for the tmp data left there.
then it will reboot from image. and data file for a soft reboot is not on the swap partition
this seems to me to be either a power setting configuration or the bios clock is not in sync with the time server.
Quote:
Sep 7 00:01:35 Sapphire-home kernel: [ 32.196689] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
Sep 7 00:01:35 Sapphire-home kernel: [ 33.738862] swsusp: Resume From Partition 254:4
Sep 7 00:01:35 Sapphire-home kernel: [ 33.738865] PM: Checking swsusp image.
Sep 7 00:01:35 Sapphire-home kernel: [ 33.756372] PM: Resume from disk failed.
There is no real problem unless some one is logging in as sudo. Ubuntu is real big on setting up power configuration since it is for dell distro's. Most likely the default setting are for the system to power down to suspend to ram. They do this for lap tops. but if you do not configure it to resume or sleep the scripts still run and you get log messages.
Good luck.

Last edited by Drakeo; 09-08-2009 at 10:01 AM.
 
Old 09-08-2009, 10:35 AM   #14
i92guboj
Gentoo support team
 
Registered: May 2008
Location: Lucena, Córdoba (Spain)
Distribution: Gentoo
Posts: 4,063

Rep: Reputation: 381Reputation: 381Reputation: 381Reputation: 381
Quote:
Originally Posted by Drakeo View Post
Should ask why does my restart log show this times when I am not there to reboot it.
I haven't seen *your* logs, but the logs shown in this thread are about *syslog* restarting, and not about the whole system restarting, as I already said in my previous post.

This is form the first post:

Code:
messages:Sep 7 06:45:01 Server1 syslogd 1.5.0#1ubuntu1: restart.
It's the system logger restarting, not your box rebooting, which is quite a different thing. I already explained why the logger restarts every now and then in the other post as well.

Maybe I am missing something, but I fail to see a problem in the whole thread.

The few lines of log you quoted on the previous post are from your kernel, and have nothing to do with the original purpose of this thread.

Last edited by i92guboj; 09-08-2009 at 10:37 AM.
 
Old 09-08-2009, 04:15 PM   #15
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,576
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
Hello i92guboj

The issue is that /var/log/messages shows the same "syslogd 1.5.0#1ubuntu1: restart" message on both boot and restarting syslogd. As I understand fusion1275's posts, the messages in /var/log/messages immediately after "syslogd 1.5.0#1ubuntu1: restart" and the uptime both suggest that most of the "syslogd 1.5.0#1ubuntu1: restart" messages come from boots rather than from syslogd restarts.

Best

Charles
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Solaris Installation - System Keeps Rebooting qs_tahmeed Solaris / OpenSolaris 3 07-18-2005 01:34 AM
problems after rebooting the system!! sharmashikha Linux From Scratch 2 07-09-2005 03:29 AM
System automatically rebooting! defa0009 Linux - General 13 03-23-2004 12:01 PM
Help, system is rebooting nightly.. BxBoy Linux - General 3 12-18-2003 04:21 PM
Self Rebooting System hubergeek Linux - General 2 06-11-2003 09:36 PM


All times are GMT -5. The time now is 02:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration