Is your Linux system unexpectedly shutting down or rebooting on its own? Well, there are several reasons for an unexpected shutdown or reboot of your Linux system, like excessive heating, hitting the power button, low battery in case of laptops, etc. But for Linux servers, you must check what caused the system reboot. You can identify the cause in a number of ways but first of all, you must understand why system reboot matters.
What Does Reboot Mean in Linux Systems?
In Linux, whenever you complete software or a network update, you need to reboot the system so that the change becomes effective on the system.
But what if your Linux system is rebooting unexpectedly? If you’ve updated any malicious software on the network, it can be dangerous for your PC which may lead to frequent reboot sessions. There can be other reasons too. That’s why if your system is rebooting unexpectedly, except for the reasons mentioned above, you must find out the reasons behind it.
Different Ways to Find Linux Last Reboot Reasons
Here are some of the best ways to trace the reasons that caused your Linux system to reboot:
1. Checking linux reboot reason By Inspecting Reboot Time
If you want to know the reason for the reboot, first of all, it is important to know the time of the reboot. To know the date and time of system reboot, you can use the following commands:
- Uptime – This command tells the time for which the system has been running along with the current time, and the average load.
- Procinfo – This command collects the data from the proc directory and displays it on your system.
- Who – This command lists down the users who are using the system presently.
- Last – The Last command provides a user’s login information.
- Stats – This command displays the status of the desired file or a file system.
2. finding why linux reboot by Checking The Messages
Now you know the reboot time, it’s time to check who triggered the reboot. It can be a system administrator or a root user, one with Sudo privileges. Checking the messages will be useful here. These messages store the information about the reboot. You need to access the log files to access these messages by using the tail command or using any desired editor to filter the data. It also depends on the OS type, e.g., var/log/messages contain the log file in RHEL/ CentOS systems, and var/log/syslog does the same for Debian and Ubuntu systems.
These messages do not reflect everything. You need to look for any signs that tell what caused the trouble and forced the system to reboot.
3. Inspect Auditd Logs (how to check reboot logs in linux)
To check different events, auditd is a great place to check them. Its au search tool will show you the two most recent reboots when you execute the following command:
au search –i –m system_boot, system_shutdown| tail -4
Now, this command will display the results and you can ascertain if the system reboot was graceful or not. As a result, if you see one shutdown and one system boot, it is alright, but if there are two system boots lined up in a row, it means that there is a problem.
4. SystemdJournal for Reboot List
If you want to maintain a list of the reboots, you can do so by changing the settings of the system journal. To create your own directory, you can take the help of these commands:
var/log/journal system- tempfiles –create –prefix /var/log/journal 2 systemctl –s SIGUSR1 kill systemd –journald
You can also simply make the changes in the /etc/system/journal.conf command. Now, you can call for the list of linux reboot logs by using the following command:
$ journalctl –list - boots
To Wrap it Up
The aforementioned commands are not to be used in an isolated manner because they may not be of much use. You need to collect entire data using different commands and their combinations. There is no one particular reason for a reboot to occur. Sometimes, the reboot happens due to a software update while other times, it may be due to overheating or accidental pressing of the power button.