4

This morning I found the machine not running. Last Friday night everything was still running. I'm trying to find out what happened.

I've had a look at "last" - besides the enigmatic "crashes" of last Wednesday there's nothing weird there. (no clue what those are either)

me       pts/0        :0.0             Mon Oct 29 08:42   still logged in   
reboot   system boot  3.5.6-1-ARCH     Mon Oct 29 08:41 - 08:49  (00:07)    
me       pts/1        :0.0             Wed Oct 24 18:37 - crash (4+15:04)   
me       pts/0        :0.0             Wed Oct 24 16:36 - crash (4+17:05)   
reboot   system boot  3.5.6-1-ARCH     Wed Oct 24 16:36 - 08:49 (4+17:13)   
me       pts/0        :0.0             Wed Oct 24 16:34 - 16:34  (00:00)

The last entries in the logs date from this morning "Oct 29 07:28:12". The next entries are those of me rebooting the system. I think that excludes the winter time change of last Sunday at 3 AM.

Is there anyplace else I can look for clues ?

Jan Goyvaerts
  • 161
  • 1
  • 2
  • 1
    Just as an aside, perhaps you should consider monitoring the machine so that you don't get surprises like the machine not running. – John Gardeniers Oct 29 '12 at 09:06
  • /var/log can give several information –  Oct 29 '12 at 09:10
  • I've checked all logs I could find. They suddenly end at this morning. Would a hard shutdown be logged ? Ie somebody pressing- and holding the power button ? – Jan Goyvaerts Oct 29 '12 at 09:48

1 Answers1

2

You should check in /var/log the files syslog, messages, dmesg, daemon.log, auth.log (there might be versions of them with .0/.1/.2.gz/.. append which will tell you even more what happened in the last time. (The extensions of these files will depend on your logrotate settings). Generally you could check all files in /var/log but the mentioned file are those that most likely contain relevant information.

Uwe L. Korn
  • 224
  • 1
  • 14