On Thu, Jul 16, 2009 at 10:27 AM, Marko Vojinovic<vvmarko at gmail.com> wrote: > On Thu, Jul 16, 2009 at 11:06 AM, Michael Calizo<mike.calizo at gmail.com> wrote: >> can you post the output of last command? >> >> Maybe we can find something like the account currently login when server >> reboots. > > Here goes (note that it is sorted in most-recent-first fashion): > > # last -R | less > vmarko pts/1 Thu Jul 16 16:09 still logged in > vmarko pts/1 Thu Jul 16 16:05 - 16:07 (00:02) > vmarko pts/1 Thu Jul 16 11:37 - 11:37 (00:00) > vmarko pts/1 Thu Jul 16 02:48 - 02:59 (00:10) > reboot system boot Wed Jul 15 18:16 (21:59) > reboot system boot Wed Jul 15 15:37 (00:03) > vmarko pts/1 Wed Jul 15 15:34 - 15:34 (00:00) > vmarko pts/1 Wed Jul 15 14:42 - 15:16 (00:34) > reboot system boot Wed Jul 15 14:37 (01:04) > vmarko pts/1 Wed Jul 15 13:38 - crash (00:58) > reboot system boot Wed Jul 15 13:36 (02:04) > reboot system boot Wed Jul 15 12:36 (03:05) > reboot system boot Wed Jul 15 11:35 (04:05) > reboot system boot Wed Jul 15 10:38 (05:02) > reboot system boot Wed Jul 15 09:34 (06:06) > reboot system boot Wed Jul 15 08:34 (07:07) > reboot system boot Wed Jul 15 07:33 (08:07) > reboot system boot Wed Jul 15 06:33 (09:08) > reboot system boot Wed Jul 15 05:32 (10:08) > reboot system boot Wed Jul 15 04:32 (11:09) > reboot system boot Wed Jul 15 03:31 (12:09) > reboot system boot Wed Jul 15 02:31 (13:10) > reboot system boot Wed Jul 15 01:30 (14:10) > reboot system boot Wed Jul 15 00:30 (15:10) > reboot system boot Tue Jul 14 23:30 (16:11) > reboot system boot Tue Jul 14 22:29 (17:11) > reboot system boot Tue Jul 14 21:29 (18:12) > reboot system boot Tue Jul 14 20:28 (19:12) > reboot system boot Tue Jul 14 19:28 (20:13) > reboot system boot Tue Jul 14 18:27 (21:13) > reboot system boot Tue Jul 14 17:27 (22:14) > reboot system boot Tue Jul 14 16:26 (23:14) > vmarko pts/1 Tue Jul 14 15:39 - 15:42 (00:03) > reboot system boot Tue Jul 14 15:26 (1+00:15) > vmarko pts/1 Tue Jul 14 15:11 - crash (00:14) > ljubica pts/1 Tue Jul 14 14:26 - 15:11 (00:44) > ljubica :0 Tue Jul 14 14:26 - 14:54 (00:27) > ljubica :0 Tue Jul 14 14:26 - 14:26 (00:00) > reboot system boot Tue Jul 14 14:25 (1+01:15) > ljubica pts/2 Tue Jul 14 13:27 - 13:27 (00:00) > ljubica pts/1 Tue Jul 14 13:27 - crash (00:58) > ljubica :0 Tue Jul 14 13:27 - crash (00:58) > ljubica :0 Tue Jul 14 13:27 - 13:27 (00:00) > reboot system boot Tue Jul 14 13:25 (1+02:16) > ljubica pts/1 Tue Jul 14 12:48 - crash (00:36) > ljubica :0 Tue Jul 14 12:48 - crash (00:36) > ljubica :0 Tue Jul 14 12:48 - 12:48 (00:00) > reboot system boot Tue Jul 14 12:41 (1+02:59) > ljubica pts/1 Tue Jul 14 11:45 - crash (00:55) >From the last log it looks like user "ljubica" did something that was causing his session to crash, then he did something to cause the server to reboot every hour. I would ask him/her what was done, it may be operator error on his/her part. -Ross