how to check logs after a black screen freeze?

Recently did a fresh install from FC2 to FC4. I like the new features, but this morning I found a black screen waiting for me. Keyboard was frozen; capslock light didn't work. Screen was on, just black. Mouse did nothing. Ctrl-Alt-Del did nothing. I powered off, waited 20 seconds, powered on, startup as normal.

... But I'd like to know what happened. (Never happened under FC2) Where should I check?

And: is there a good log viewer package to help me? Thanks

I believe its under /var/log/messages

If not dig around in /var/log and you should find your answer.

/var/log/messages

OK, if I'm reading it right, everything was fine, pam was doing it's thing every hour, and then suddenly it stopped. ?

I guess I was hoping for more information. I guess if the kernel freezes then there won't be any useful log. But why would it freeze--would compiling the kernel help me?

Also, can anyone recommend something I should look for in Logwatch reports?

Happened again! I was away from the machine for ~30 hours. Symptoms:

- Left the machine by clicking Desktop > Lock Screen
EARLIER TODAY:
- Keyboard frozen, CapsLock light on but not responding
- Screen black (signal reaching the monitor, just black) My screen saver is black screen w/no power managment w/screen lock, so it looked like how I left it
- HD LED light NOT flashing, not being used
- CDROM will open. I had a blank CD in so it wasn't mounted
- Network card LED light on & flashing occasionally, like normal
RESTART
- a slow bittorrent (all four FC4 cds) was stopped midway through... should have been done about 20 hours previous, but the speed might have slowed while I was gone.

While it was still on (and black), I captured network packets on a different machine using Ethereal.. though, now I know that isn't terribly helpful when plugged into a switch.


Any webpages I should read? Any more clever way to use Etherreal in the future? (for example, connecting the cable to a different machine with the same local IP?)

I don't know what to search for, and I don't even know what the problem might be. Is there a way I can tell if it's a kernel freeze? I strongly doubt intrusion, but ya never know.


EDIT: -------------------------
Correction: I was away from the machine for about 38 hours. Looking at /var/log/messages, the lock happened between 35 and 34 hours ago, so the bittorrent had no way to finish by that time. I was going full speed until the freeze.

This is what I would do.

Reinstall and see if that fixes the problem. If you keep having the same problems then it almost sounds like a hardware issue. Maybe that CPU is starting to run too hot. There could be other issues with your hardware such as motherboard or ram. Are you running the latest BIOS for your motherboard? Have you updated your bios for your mother board recently or never?

Did you built the machine or buy it from someone?

Originally posted by brianthegreat Reinstall and see if that fixes the problem. If you keep having the same problems then it almost sounds like a hardware issue.

but the OP gave me the impression the problem started occuring when he upgraded his OS - this would make it sound like a software issue... i'd say what you'd wanna test for is ocurrance of the problem on other distros... like maybe boot a knoppix cd and confirm the problem does or doesn't happen there also... it might be a FC4-specific issue for all we know - in which case re-installing it wouldn't help...

Maybe that CPU is starting to run too hot. There could be other issues with your hardware such as motherboard or ram. Are you running the latest BIOS for your motherboard? Have you updated your bios for your mother board recently or never?

i recommend memtest86+ to test your system's volatile memory... chekcing the BIOS settings wouldn't be a bad idea either, especially anything power-management related as it sounds like your problems occur when the system is in sleep state but i'm not sure...

BTW, one thing you could try if you determine the problem only happens in FC4 (even if you re-install) is re-compiling the kernel using less options and/or the latest stable kernel version (2.6.14 at the time of this post)...

just my $0.02...