How to know why server keeps restarting?
You can use the following 2 commands (who
& last
) to find out the last time the system was rebooted and also messages about previous shutdown or runlevel changes.
Last time system booted?
For this you can use the who
command. Specifically with the -b
switch.
$ who -b
system boot 2013-08-01 17:56
This says the last time the system was booted was 2013-08-01.
Past reboots
If you're interested in seeing a more extensive list of previous reboots you can use the last
command.
$ last reboot | less
reboot system boot 2.6.35.14-106.fc Thu Aug 1 17:56 - 02:03 (7+08:06)
reboot system boot 2.6.35.14-106.fc Thu Aug 1 09:41 - 17:55 (08:14)
reboot system boot 2.6.35.14-106.fc Thu Jul 25 15:24 - 17:55 (7+02:31)
reboot system boot 2.6.35.14-106.fc Thu Jul 18 18:05 - 15:23 (6+21:17)
...
Past system shutdowns & runlevel changes?
You can use the last
command for this too. You'll need to use the -x
switch.
$ last -x | less
saml pts/7 :pts/6:S.0 Sat Aug 3 21:30 - 21:30 (00:00)
saml pts/6 :0.0 Sat Aug 3 21:29 - 21:30 (00:01)
saml pts/4 :0.0 Fri Aug 2 21:49 - 22:16 (2+00:26)
saml pts/2 :0.0 Fri Aug 2 13:30 - 22:16 (2+08:45)
saml pts/1 :0.0 Fri Aug 2 13:05 still logged in
saml pts/0 :0.0 Fri Aug 2 12:37 still logged in
saml pts/0 :0.0 Fri Aug 2 12:35 - 12:37 (00:02)
saml pts/0 :0.0 Thu Aug 1 17:58 - 12:35 (18:36)
saml tty1 :0 Thu Aug 1 17:56 still logged in
runlevel (to lvl 5) 2.6.35.14-106.fc Thu Aug 1 17:56 - 02:04 (7+08:08)
reboot system boot 2.6.35.14-106.fc Thu Aug 1 17:56 - 02:04 (7+08:08)
shutdown system down 2.6.35.14-106.fc Thu Aug 1 17:55 - 17:56 (00:00)
runlevel (to lvl 6) 2.6.35.14-106.fc Thu Aug 1 17:55 - 17:55 (00:00)
saml tty2 Thu Aug 1 17:54 - down (00:01)
root tty2 Thu Aug 1 17:53 - 17:54 (00:00)
...
References
- who man page
- last man page
/var/log/messages
That is the main log file you should check for messages related to this. Additionally either /var/log/syslog
(Ubuntu) or /var/log/secure
(CentOS)
To find out when your server was last rebooted just type uptime
to see how long it has been up.