Server rebooting for no reason, logs?

shorto · 03-29-2012, 06:01 PM

Hello all!

Well I found today that my server had rebooted and I got get the logs...

Quote:

Mar 29 12:26:59 kakashi-sensei shutdown[8205]: shutting down for system reboot
Mar 29 12:27:00 kakashi-sensei init: Switching to runlevel: 6

Is there a way to see why the system rebootet or how it came to this? I mean was it via ssh or something other?

Cheers,
shorto

frankbell · 03-29-2012, 08:02 PM

This might tell you something. I just tested it.

Code:

# cat /var/log/messages | grep shutdown
Mar 29 21:01:17 tuna shutdown[14571]: shutting down for system halt

Edit: If you find a shutdown command, you can then search backwards for an ssh connection.

singhjc · 03-30-2012, 03:29 AM

hello if you suspect like somebody reboot your system through ssh then you can just check through

#utmpdump /var/log/wtmp | cat

it will tell you which ip had accessed your system and what was the time.