Hi,

If the server crashed unexpectedly how can we find the reason behind it? I have checked /var/log/messages and unable to find the cause. How can I understand if someone ourposefully rebooted the server. NOthing found in history. Someone adviced me to use the below command.
===
root@server [/var/log]# grep -i cmd /var/log/messages
Aug 29 09:44:26 server pure-ftpd: (?@127.0.0.1) [INFO] __cpanel__service__auth__ftpd__YuVKgaWqnjmsn0iNcMDOuGJbqJqqoVBONOYBpPXQHrkvPxj7pqv97GJbckqXGXZ9 is now logged in
Aug 29 09:44:26 server pure-ftpd: (__cpanel__service__auth__ftpd__YuVKgaWqnjmsn0iNcMDOuGJbqJqqoVBONOYBpPXQHrkvPxj7pqv97GJbckqXGXZ9@127 .0.0.1) [INFO] Logout.
Aug 29 13:16:58 server kernel: ata1: PATA max UDMA/100 cmd 0xe040 ctl 0xe030 bmdma 0xe000 irq 177
Aug 29 13:16:59 server kernel: ata3: SATA max UDMA/133 cmd 0xf190 ctl 0xf180 bmdma 0xf150 irq 185
Aug 29 13:16:59 server kernel: ata4: SATA max UDMA/133 cmd 0xf170 ctl 0xf160 bmdma 0xf158 irq 185
Aug 29 13:16:59 server kernel: ata5: SATA max UDMA/133 cmd 0xf130 ctl 0xf120 bmdma 0xf0f0 irq 185
Aug 29 13:16:59 server kernel: ata6: SATA max UDMA/133 cmd 0xf110 ctl 0xf100 bmdma 0xf0f8 irq 185
root@server [/var/log]#


can anyone answer my doubts? Thanks in advance. :-)

first tell what kind of server you are using mail server , file server web server........

put output of log.

/var/log/http/access.log
/var/log/maillog