Edit page

Find Why a Linux Server Rebooted

Title

Slug

Status

Context

Categories

Topics

Markdown

---
links:
  - "[[Linux]]"
  - "[[Linux Tshoot]]"
tags:
  - linux
status: no-status
category: howto
focal_points:
opened: 06-01-2026
---
## What this is for

This explains:

- How to check **when** and **how** a RHEL server rebooted
- How to tell if the reboot was caused by:
    - a person or script inside the server
    - or by infrastructure (VM reset, power, hypervisor)
- How to make sure **future reboots can be investigated**
    
---

## 1. Check when the server rebooted

`who -b uptime`

Confirms the last boot time.

---

## 2. Check reboot history

`last -x | head`

What to look for:

- `reboot system boot` → normal reboot
- `shutdown system down` → clean shutdown (manual or automated)
- No shutdown entry → likely VM reset or power event

---

## 3. Check logs from the previous boot

`journalctl -b -1`

If you see:

`No persistent journal was found`

It means logs were lost at reboot and **the cause cannot be proven** from inside the server.

---

## 4. Key conclusion when logs are missing

If there are:

- no shutdown logs
- no kernel panic
- no persistent journal

Then the reboot was **not triggered from the operating system**.  
It was almost certainly caused by infrastructure (hypervisor, power, maintenance).

---

## 5. Enable persistent logs (recommended)

This ensures future reboots leave evidence.

### Create log storage

```
mkdir -p /var/log/journal
chown root:systemd-journal /var/log/journal
chmod 2755 /var/log/journal
```

### Configure limits
Edit:
`vi /etc/systemd/journald.conf`

Set:
```
Storage=persistent
SystemMaxUse=500M
SystemKeepFree=1G
```

Apply:
`systemctl restart systemd-journald`

Check usage:
`journalctl --disk-usage`

---

## What this gives you

After this:

- OS reboots → visible in logs
- Clean shutdowns → visible
- VM or power resets → logs abruptly stop (proof it wasn’t the OS)
- Disk usage → capped and safe

---

## Summary

If a server reboots:

- Logs present → you can explain why
- Logs missing → infrastructure caused it

This setup removes guesswork.

Cancel