Hello! I am really desperate, thus that kind of title to catch attention maybe

In our firm I set up an intra-net server (Debian Sarge with 2.4.27-1-386
kernel) myself for php and mysql development. Everything is fine, but when I logged in today, just out of curiosity ran "uptime" command and saw that the server was rebooted 2 days before I haven't touched the server for nearly a month.

Here is the output of "last reboot" command:

reboot system boot 2.4.27-1-386 Sun May 22 09:58 (2+04:38)
reboot system boot 2.4.27-1-386 Sun May 22 05:10 (2+09:25)
reboot system boot 2.4.27-1-386 Tue May 17 02:14 (7+12:21)
reboot system boot 2.4.27-1-386 Tue May 17 02:10 (7+12:25)
reboot system boot 2.4.27-1-386 Mon May 16 02:04 (8+12:31)
reboot system boot 2.4.27-1-386 Mon May 16 02:01 (8+12:34)
reboot system boot 2.4.27-1-386 Thu May 5 09:22 (19+05:13)
reboot system boot 2.4.27-1-386 Thu May 5 08:38 (19+05:57)

So does anyone have any clue on why this is happening? I did not change any hardware, nor did I touch the network.

Thank you very much in advance!

"when I logged in today, just out of curiosity ran "uptime" command and saw that the server was rebooted 2 days before. I haven't touched the server for nearly a month."

The reboot could have been caused by a temporary power outage. Did you have a power failure? Did the cleaning staff pull the power cord to plug in their vacuum cleaner?

---------------------------
Steve Stites

Thanks Steve for replying.

I am sure there was no power outage (we use ups) and no cleaning stuff is allowed to that cold server room. If you look at some restart times you'll notice that it's not even work hours (most of them happened duringthe night). I am suspecting some kind of cron job that does some job and restarts but how can I see more logs?

Thanks again!

It seems odd that a cron job would re-boot at random times in the early morning each day. Rebooting kills all processes on the system and would be dangerous to have rebooting at random times. Are you sure about the physical security of the server room? I've got a standard Debian Sarge install as my workstation and the only time it reboots is when I shut it down each night. In fact, I would be highly upset if it rebooted while I was working on something.

Actually this server did not have this kind of problem for nearly 6 months now and was running very good. I am sure that the room is safe, again that makes me nervous too.

Let's say, someone presses reset button or pulls the cable off. What kind of logs do I get if this is the case? What differences are there between this probable situation and when say someone logging in remotely and resetting it? BTW, it seems that reboot command was called by "system". So no remote root exploits I think. It would be nice if someone pointed me to the place where I can get some info about log files. Also I noticed that some reboot times are very close to each other. I am also suspecting the air conditioner in the server room. Sometimes I cought it stopped and the room very hot. Can heat make linux server (IBM, don't remember the model) ever reboot? Rootkit?

Well u can install chkrootkit and scan your system. Just to make sure.

Heat can cause random shutdowns and reboots. The first thing I would try is opening up the case and making sure that all fans are running (check inside the power supply also). If the power supply or CPU is overheating, you can get all kinds of weird things happening. I recently had a system fail because the power supply fan quit spinning. It would run normally until it got hot and then would spontaneously shutdown.

If the fans are all spinning as they should, you can check cpu, case, and hard drive temperatures if your hardware supports it. Try installing ksensors:You will then need to run "sensors-detect" as root. It is a script that will walk you through detecting sensors and modifying /etc/modules to load the neededs drivers for temperature sensors. You can then see temperature sensors with the command "sensors". You can also run "ksensors" to see sensors (of course, I am assuming that you have X-windows on your server). If you don't have X-windows, you can just install lm-sensors: Hddtemp will give hard drive temperature, but your CPU temperature is likely the culprit.

If the CPU is running hot, check the heatsink fan, then try re-seating the heatsink with thermal grease. If you have a pentium CPU, it is probably not heat damaged because they have safety features. If you have an Athlon XP, you may need a new processor if it has been run too hot. Good luck!

Thanks for helpful suggestions yates, I'll definitely check that out. Will keep posting though.

Thanks again.