Rebooting a Linux device can happen for several reasons. This could be a normal restart of the operating system by the user, an automatic installation of updates, kernel panics, physical hardware failures, software errors, or a power failure.
If your Linux server has rebooted unplanned, there are several ways to find out why and check the cause.
Get operating system boot time:
$ who -bsystem boot 2023-10-26 09:07
You can also use the last command to display information about host reboots:
$ last -x | head | tacList of recent Linux reboots from the logs:
$ journalctl --list-boots
Or the entire reboot history:
$ last rebootTo find out the reasons for a particular restart, run the command
$ journalctl -b {num}-nReplace {num} with the entry index in the output of journalctl –list-boots command.
In my example, you can see that the reboot of the host has been initiated by a cron job that performs an automatic update of the HestiaCP web panel.
In some cases, you may need to analyze log files to get information about why Linux rebooted.
- CentOS/RHEL/Rocky/Oracle Linux –/var/log/message
- Ubuntu/Debian – /var/log/syslog
To quickly find the reasons for the reboot in the system logs, use the following bash script:
$ sudo grep -iv ': starting\|kernel: .*: Power Button\|watching system buttons\|Stopped Cleaning Up\|Started Crash recovery kernel' \
/var/log/messages /var/log/syslog /var/log/apcupsd* \
| grep -iw 'recover[a-z]*\|power[a-z]*\|shut[a-z ]*down\|rsyslogd\|ups'In my example, the log contained the following line
systemd[1]: Started Unattended Upgrades Shutdown.
This means that automatic unattended upgrading is enabled for this Ubuntu host (you can disable it as follows).