Linux Server Crash

[johngiggs]

I have a test Linux server running RH 8 and Apache 2.0. I am the only one who uses the server and there aren't any special scripts or processes running on it yet. The server went down somehow on Monday at 05:41. When I run last it says:

reboot system boot 2.4.18-14 Mon Nov 8 05:41 (1+06:15)

I briefly reviewed /var/log/messages and didn't see any errors that stand out. The last entry in the messages file before the server came up is timestamped 11/7 at 23:59 which is when I run a system check script. I checked for core files and did't find any. Can anyone point me in the right direction as to how to investigate why the server went down?

Thanks,

John

 

[mrregan]

IS IT POSSIBLE YOU LOST POWER, IS THIS HOOKED INTO A BATTERY?

 

[marsd]

Firstly I would increase your log level for all system events
to informational for the time being.
Secondly I would add a script to your halt.local init script
that mails you a snapshot of all running processes and a
dump of the command history.

Good Luck.

 

[johngiggs]

marsd,

My syslog.conf has the following entry:

*.info;mail.none;authpriv.none;cron.none /var/log/messages

What else should I add? As far as the halt.local, can you give me an example of how you log the processes and dump the command history?

Would something like this be sufficient to view the command history or is there an easier way?

>historylog;for file in $(find / -name .*_history); do echo "\n========= $file ==========\n" >> historylog; cat $file >> historylog;done

Thanks,

John

 

[marsd]

john,

I would keep it simple:

all=$(history)
processes=$(ps aux)
echo "At shutdown 1> History: $all" | mail me@here
echo "At shutdown 2> Processes: $processes | mail me@here

Or of course log it to some static state file if you can't rely on mail to be running when halt.local executes, which
may be the case.