I have the linux centos 7 server in datacenter. Server suddently rebooted but we didn't restart the server and datacenter people also claim that he didn't reboot the server.
Now I want to know how server suddently restared ??
Is anybody run linux command reboot via command prompt or anybody have have directly press the reboot switch in datacenter.
I checked /var/log/message but not able to conculed anything.
Please guid how I can identified via log that its hard booted or via command ???
Check out the output from the last command to make sure it was not rebooted by one of your users/admins it will also give you precise time of the boot.
Here is quick oneliner that will list the last 100 prior the boot event:
BOOT_DATE=$(last | grep boot | head -1 | awk '{print $6, $7}') ; last | grep "$BOOT_DATE" | grep -A 100 "boot"
Output:
reboot system boot 3.10.0-693.21.1. Wed Mar 21 13:54 - 15:23 (9+00:28)
root pts/0 <HIDDEN> Wed Mar 21 13:53 - 13:54 (00:00)
reboot system boot 3.10.0-693.21.1. Wed Mar 21 13:51 - 13:54 (00:02)
root pts/0 <HIDDEN> Wed Mar 21 13:50 - 13:50 (00:00)
reboot system boot 3.10.0-693.21.1. Wed Mar 21 13:45 - 13:51 (00:05)
root pts/0 <HIDDEN> Wed Mar 21 13:43 - 13:44 (00:00)
Having the exact time, search in messages for any events before that time.
If you suspect that the system was rebooted by button press, edit /etc/sysconfig/acpid and put the following:
OPTIONS="-l"
That will make acpid log button presses before shutting down/rebooting the system. Unfortunately it is not enabled by default so you will no see those events for your current incident.
Lastly, if the system lost power/the cable was yanked off, there is no way to know that within the system.
