Hi everyone

I'm almost new in Linux systems and having trouble. I hope someone can help me.

The problem is there're 6 VM on ESX and they're identically same. 2 of them reboot last night. I searched log files but couldn't find anything. So, here is the info. you may want during solution :

# last reboot
reboot system boot 4.4.0-62-generic Wed Nov 15 22:50 still running (which is last night )
reboot system boot 4.4.0-62-generic Mon Nov 13 00:31 still running
reboot system boot 4.4.0-62-generic Wed Nov 8 15:21 still running

#lsb_release
Ubuntu 16.04.3 LTS

#uname -a
4.4.0-62-generic #83-Ubuntu SMP Wed Jan 18 14:10:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

I wanted to share kern.log but forum said it's too long. There are some part which I don't know what that means.


And I wanna ask this too, what is the first line in reboot which tell you to "machine is rebooting now"


kern.log


Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] e820: last_pfn = 0xc0000 max_arch_pfn = 0x400000000
Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] found SMP MP-table at [mem 0x000f6b30-0x000f6b3f] mapped at [ffff8800000f6b30]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] Scanning 1 areas for low memory corruption
Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] Base memory trampoline at [ffff880000099000] 99000 size 24576
Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] BRK [0x0220b000, 0x0220bfff] PGTABLE

Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] smpboot: Allowing 8 CPUs, 0 hotplug CPUs
Nov 15 22:50:16 HOSTNAME kernel: [ 0.000000] PM: Registered nosave memory: [mem 0x00000000-0x00000fff]


Nov 15 22:50:16 HOSTNAME kernel: [ 0.947247] pci 0000:00:15.4: BAR 13: failed to assign [io size 0x1000]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.947414] pci 0000:00:15.3: BAR 13: no space for [io size 0x1000]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.947572] pci 0000:00:15.3: BAR 13: failed to assign [io size 0x1000]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.947738] pci 0000:00:01.0: PCI bridge to [bus 01]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.948333] pci 0000:02:00.0: BAR 6: assigned [mem 0xfd500000-0xfd50ffff pref]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.948585] pci 0000:00:11.0: PCI bridge to [bus 02]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.948941] pci 0000:00:11.0: bridge window [io 0x2000-0x3fff]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.949378] pci 0000:00:11.0: bridge window [mem 0xfd500000-0xfdffffff]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.949661] pci 0000:00:11.0: bridge window [mem 0xe7b00000-0xe7ffffff 64bit pref]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.950153] pci 0000:00:15.0: PCI bridge to [bus 03]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.950395] pci 0000:00:15.0: bridge window [io 0x4000-0x4fff]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.950647] pci 0000:00:15.0: bridge window [mem 0xfd400000-0xfd4fffff]
Nov 15 22:50:16 HOSTNAME kernel: [ 0.950902] pci 0000:00:15.0: bridge window [mem 0xe7a00000-0xe7afffff 64bit pref]

You should see evidence in one of the kernel log files, or the dmesg command, that documents the reboot sequence.

But the first order of business should be to figure out exactly why these machines were restarted! (Who did it, and why?) The virtual-machine monitor might also have important clues, e.g. if the VMs crashed due to some kind of panic and the monitor is set to automatically reboot them – which is usually not done because of the probability of a reboot-loop. You should regard the present case with suspicion, and, if you're new at this, ask for another pair of eyes.

I looked every log file in /var/log but found nothing. I doubt that the VM is crashed. Those who're loking VM side said nothing happened. So what am I missing ?

you gave no usable information, so I can only guess:
in /var/log/messages (or somewhere next to this file) you need to see if something happened just before boot. And also you can see how it was booted. You need to check the logs of the VMs (=inside) and the logs on the host about the VM related events.