Where to find the system logs after reboot

[Wilfredo R. Castro]

I need your help !
My HP L class server always rebooted in the morning automatically. But I dont know where I can find the LOGS on why the machine rebooted ?

I suspect that it exceeded the allowable temperature needed.

Thank you in advance for the help.

[Con O'Kelly]

Hi

First off check /etc/shutdownlog.

Also check
/var/adm/crash
/var/tombstones

There should be a crash dump in /var/adm/crash. You will most likely need to log a call with HP so that they can examine the crash dumps and pinpoint the reason for the system crash.

Cheers
Con

[Michael Tully · Accepted solution]

Check:

/etc/shutdownlog
/var/adm/syslog/syslog.log

You may have a crash dump in here.
/var/adm/crash

If you have one you an analyse it with q4 or get HP to do it if you have a support contract. Was the room over 35 degress celcius?

[Wilfredo R. Castro]

Thanks for the replies, but I cannot find any errors among those logs :


1.
/etc/shutdown :
00:01 Tue May 13, 2003. Halt:
21:14 Fri Nov 7, 2003. Halt:
09:34 Sat Mar 13, 2004. Halt:
(why is that the last halt was Mar 13? while it was just rebooted Aug 5).

2.
syslog includes only the initialization.

3.
No /var/adm/crash file present
(Does this mean that it doesn't crash?)

How do I know what causes the reboot? is there any other way? I even go to GSP/SL to check but I can't seemed to find any errors for defective hardware ..etc.

Thanks for the replies.

[Michael Tully]

Have a look at the tail of /var/adm/syslog/OLDsyslog.log
There could be a message that the system was rebooted because of the temp. (see /etc/envd.conf) In saying that there should be an entry in syslog (the old one) according to the man pages of envd

man envd

[Patrick Wallek]

You should also check the /var/adm/OLDsyslog.log file. If it is rebooting every morning at the same time, with no indications in any of the log files, then I would suspect a power issue. Is this machine on a UPS? Are you somehow losing power during the night and the UPS is draining causing the machine to lose power? If power is then restored later the machine would boot automatically.

[Wilfredo R. Castro]

Patrick,

You maybe right and I turn on the UPS monitoring. I also suspected that since I haven't seen any error logs that could lead to a defective hardware.

I also haven't seen anything wrong with the OLDSyslog.

[Bill Hassell]

The directory /var/adm/crash must exist. If it doesn't, then the system will crash and never report the reason. Create the directory, then edit the file /etc/rc.config.d/savecrash to save crash dumps. You should also look at the log kept by the GSP board. On the console, type CTRL-B (the ctrl key plus the letter b). You'll get a GSP login request. The login and password are probably not set, just press enter a couple of times. Then use the ER command to look at the logs. If you see a high temp warning, you have much bigger problems! All the computers, tape drives, printers, disk arrays, etc in that room may be damaged by extreme temperatures.

The L-class will turn itself off before it is damaged but tape drives and printers and disks will be permanently damaged. Make sure your computer room has a temperature controlled circuit breaker that removes all power when the temperature is too high. I have seen thousands of dollars of equipment destroyed because someone turned off the air conditioner by accident.

[Wilfredo R. Castro]

Hi Bill,

Thanks for the reply. I have a folder /var/adm/crash for there's no file exists inside the folder.

I've also check the GSP--> ER but I haven't seen anything about temperature problem. Should we say that I dont dont have a temperature problem?

[Steven E. Protter]

Do a quick bdf and see if /var mounted. Sometimes in these situations you can't find the logs because /var didn't mount.

The prior answers were excellent and I have nothing to add. Except what I just did.

:-)

SEP