Base on last output, I would start to look on the process that was invoke by ljubica and vmarko, you might find something from there.

Anyways, is your server running any DB process? You might also look at the server history on when this problem start to happened and investigate any updates that you or the others have done prior to the problem. SAR command can help. 

Mike -- 

On Fri, Jul 17, 2009 at 12:45 AM, Ross Walker <rswwalker@gmail.com> wrote:
On Thu, Jul 16, 2009 at 10:27 AM, Marko Vojinovic<vvmarko@gmail.com> wrote:
> On Thu, Jul 16, 2009 at 11:06 AM, Michael Calizo<mike.calizo@gmail.com> wrote:
>> can you post the output of last command?
>>
>> Maybe we can find something like the account currently login when server
>> reboots.
>
> Here goes (note that it is sorted in most-recent-first fashion):
>
> # last -R | less
> vmarko   pts/1        Thu Jul 16 16:09   still logged in
> vmarko   pts/1        Thu Jul 16 16:05 - 16:07  (00:02)
> vmarko   pts/1        Thu Jul 16 11:37 - 11:37  (00:00)
> vmarko   pts/1        Thu Jul 16 02:48 - 02:59  (00:10)
> reboot   system boot  Wed Jul 15 18:16          (21:59)
> reboot   system boot  Wed Jul 15 15:37          (00:03)
> vmarko   pts/1        Wed Jul 15 15:34 - 15:34  (00:00)
> vmarko   pts/1        Wed Jul 15 14:42 - 15:16  (00:34)
> reboot   system boot  Wed Jul 15 14:37          (01:04)
> vmarko   pts/1        Wed Jul 15 13:38 - crash  (00:58)
> reboot   system boot  Wed Jul 15 13:36          (02:04)
> reboot   system boot  Wed Jul 15 12:36          (03:05)
> reboot   system boot  Wed Jul 15 11:35          (04:05)
> reboot   system boot  Wed Jul 15 10:38          (05:02)
> reboot   system boot  Wed Jul 15 09:34          (06:06)
> reboot   system boot  Wed Jul 15 08:34          (07:07)
> reboot   system boot  Wed Jul 15 07:33          (08:07)
> reboot   system boot  Wed Jul 15 06:33          (09:08)
> reboot   system boot  Wed Jul 15 05:32          (10:08)
> reboot   system boot  Wed Jul 15 04:32          (11:09)
> reboot   system boot  Wed Jul 15 03:31          (12:09)
> reboot   system boot  Wed Jul 15 02:31          (13:10)
> reboot   system boot  Wed Jul 15 01:30          (14:10)
> reboot   system boot  Wed Jul 15 00:30          (15:10)
> reboot   system boot  Tue Jul 14 23:30          (16:11)
> reboot   system boot  Tue Jul 14 22:29          (17:11)
> reboot   system boot  Tue Jul 14 21:29          (18:12)
> reboot   system boot  Tue Jul 14 20:28          (19:12)
> reboot   system boot  Tue Jul 14 19:28          (20:13)
> reboot   system boot  Tue Jul 14 18:27          (21:13)
> reboot   system boot  Tue Jul 14 17:27          (22:14)
> reboot   system boot  Tue Jul 14 16:26          (23:14)
> vmarko   pts/1        Tue Jul 14 15:39 - 15:42  (00:03)
> reboot   system boot  Tue Jul 14 15:26         (1+00:15)
> vmarko   pts/1        Tue Jul 14 15:11 - crash  (00:14)
> ljubica  pts/1        Tue Jul 14 14:26 - 15:11  (00:44)
> ljubica  :0           Tue Jul 14 14:26 - 14:54  (00:27)
> ljubica  :0           Tue Jul 14 14:26 - 14:26  (00:00)
> reboot   system boot  Tue Jul 14 14:25         (1+01:15)
> ljubica  pts/2        Tue Jul 14 13:27 - 13:27  (00:00)
> ljubica  pts/1        Tue Jul 14 13:27 - crash  (00:58)
> ljubica  :0           Tue Jul 14 13:27 - crash  (00:58)
> ljubica  :0           Tue Jul 14 13:27 - 13:27  (00:00)
> reboot   system boot  Tue Jul 14 13:25         (1+02:16)
> ljubica  pts/1        Tue Jul 14 12:48 - crash  (00:36)
> ljubica  :0           Tue Jul 14 12:48 - crash  (00:36)
> ljubica  :0           Tue Jul 14 12:48 - 12:48  (00:00)
> reboot   system boot  Tue Jul 14 12:41         (1+02:59)
> ljubica  pts/1        Tue Jul 14 11:45 - crash  (00:55)

>From the last log it looks like user "ljubica" did something that was
causing his session to crash, then he did something to cause the
server to reboot every hour. I would ask him/her what was done, it may
be operator error on his/her part.

-Ross
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos



--
Mike Calizo
Registered Linux User # 365113

_________________________________________________
Even the longest journey has to start with a small first-step