Reboot information

[Konrad Hegner]

Hello all

We had a call from a customer. The machine was down. They ask me why!
I was looking in some files, but not helpful.

I know the following files, where have some information about the system:
/var/adm/syslog/OLDsyslog.log
/var/opt/resmon/log/event.log
/var/adm/crash/..
/var/tombstones/ts99
/var/adm/shutdownlog
and the mail-tool.

But I can't find any information about this last shutdown. Know anybody more files, where have some information about shutdown, crashes and so forth?

What's happen in some log-files, if I disconnect abrupt the power-connection by a running system? If there any time to write something in some log-files?

[Leif Halvarsson_2 · Accepted solution]

Hi,
You can get the time for the reboot with the "last" command.

[Michael Tully]

Have a look in the cron log file and of course cron itself.

Somebody may have left an entry from an automated reboot, that wasn't removed after it was done.

[Stefan Farrelly]

If youve checked all these logs and found nothing then only 2 possibilities;

1. sudden power loss causing a reset
2. hardware failure causing a reset

Either way there is no easy way to see which one happened. The best thing I can think to try is;

1. go to the console and scroll back as far as the console buffer will allow to see if you can see anything on the console log as to a problem, eg. if you can go far enough back to see that all filesystems needed a log replay or fsck then you know it was a crash due to power or hardware reset.

2. check the stm hardware logs - run xstm go to utility, run logtool. See if any hardware errors reported at all - this could indicate a hardware problem like the mainboard going bad or a cpu.

Last time I had a problem like this it kept happening late at night, and everybody said it must be a hardware problem as everything else in the computer room stayed up (ie. power supply failure or mainboard). So I went one night and watched it! and sure enough, in came a cleaner and unplugged our server just because it was in the floor socket she wanted to use for her vacum cleaner! no amount of checking logs on the server could point that out:-)

[john korterman]

Hi,
I guess there is no UPS on the system. In that case there will not be any trace of a stop due to a power-failure. The system will simply stop in the middle of whatever it was doing.

regards,
John K.

[Jean-Luc Oudart]

I suppose if you look at /etc/rc.log and /etc/rc.log.old you will find if the box did a "proper" shut down or not.

JL

[Tim Adamson_1]

Check uptime and confirm system rebooted.

Check /etc/rc.log and /etc/rc.log.old to determine if graceful shutdown occurred (unlikely) and system restarted.

Most likely cause is the power was stopped and the system just dropped.

Make sure system is set to take a crash dump just in case.


Tim

[Bill Hassell]

If the file /etc/shutdownlog does not exist, it will be very difficult to determine the reason for the problem. Of course, the first step is to determine what state the machine is in. "down" is not meaningful. Is the machine powered off? Or is it stuck in a selftest loop? Is it running (console is OK) but not reachable via the network?

It is impossible for any operating system to directly document a hang or crash since the opsystem is dead. The bootup steps will attempt to figure out what happened, but if the machine did not really stop (ie, the network is dead), only the 'real' console will be useful in figuring out what happened.

[Cheryl Griffin]

What type of machine? There are some issues similar to this, for specific models (such as an N or L Class machine) that are fixed by updating the firmware.

[Kent Ostby]

Konrad --

1) check what "uptime" says. Occassionally customers think their system rebooted when it didnt (really).

2) check the timestamp on the OUTSIDE of /var/adm/tombstones and that will tell you when the system came back up.

3) Is there an entry for that timeframe in the /etc/shutdownlog (aka /var/adm/shutdownlog) ?

If not then you are probably looking at a power issue.

Power issue could be anything from :
a) power supply
b) customer unplugged box
c) plug loose at back of box or at wall
d) power switch assembly
e) ups out of power

Hope this helps.

Best regards,

Kent M. Ostby

[Scot Bean]

If it's a server, cntl-B from the console may get you into the support processor.

There are console/alert logs there that may detail everything from a power failure to an HPMC.