Find Why a Linux Server Rebooted

links:

• "[[Linux]]"
• "[[Linux Tshoot]]"
  tags:
• linux
  status: no-status
  category: howto
  focal_points:
  opened: 06-01-2026

What this is for

This explains:

• How to check when and how a RHEL server rebooted
• How to tell if the reboot was caused by:
  • a person or script inside the server
  • or by infrastructure (VM reset, power, hypervisor)
• How to make sure future reboots can be investigated

1. Check when the server rebooted

who -b uptime

Confirms the last boot time.

2. Check reboot history

last -x | head

What to look for:

• reboot system boot → normal reboot
• shutdown system down → clean shutdown (manual or automated)
• No shutdown entry → likely VM reset or power event

3. Check logs from the previous boot

journalctl -b -1

If you see:

No persistent journal was found

It means logs were lost at reboot and the cause cannot be proven from inside the server.

4. Key conclusion when logs are missing

If there are:

• no shutdown logs
• no kernel panic
• no persistent journal

Then the reboot was not triggered from the operating system.
It was almost certainly caused by infrastructure (hypervisor, power, maintenance).

5. Enable persistent logs (recommended)

This ensures future reboots leave evidence.

Create log storage

mkdir -p /var/log/journal
chown root:systemd-journal /var/log/journal
chmod 2755 /var/log/journal

Configure limits

Edit:
vi /etc/systemd/journald.conf

Set:

Storage=persistent
SystemMaxUse=500M
SystemKeepFree=1G

Apply:
systemctl restart systemd-journald

Check usage:
journalctl --disk-usage

What this gives you

After this:

• OS reboots → visible in logs
• Clean shutdowns → visible
• VM or power resets → logs abruptly stop (proof it wasn’t the OS)
• Disk usage → capped and safe

Summary

If a server reboots:

• Logs present → you can explain why
• Logs missing → infrastructure caused it

This setup removes guesswork.