Base on last output, I would start to look on the process that was invoke by ljubica and vmarko, you might find something from there. Anyways, is your server running any DB process? You might also look at the server history on when this problem start to happened and investigate any updates that you or the others have done prior to the problem. SAR command can help. Mike -- On Fri, Jul 17, 2009 at 12:45 AM, Ross Walker <rswwalker at gmail.com> wrote: > On Thu, Jul 16, 2009 at 10:27 AM, Marko Vojinovic<vvmarko at gmail.com> > wrote: > > On Thu, Jul 16, 2009 at 11:06 AM, Michael Calizo<mike.calizo at gmail.com> > wrote: > >> can you post the output of last command? > >> > >> Maybe we can find something like the account currently login when server > >> reboots. > > > > Here goes (note that it is sorted in most-recent-first fashion): > > > > # last -R | less > > vmarko pts/1 Thu Jul 16 16:09 still logged in > > vmarko pts/1 Thu Jul 16 16:05 - 16:07 (00:02) > > vmarko pts/1 Thu Jul 16 11:37 - 11:37 (00:00) > > vmarko pts/1 Thu Jul 16 02:48 - 02:59 (00:10) > > reboot system boot Wed Jul 15 18:16 (21:59) > > reboot system boot Wed Jul 15 15:37 (00:03) > > vmarko pts/1 Wed Jul 15 15:34 - 15:34 (00:00) > > vmarko pts/1 Wed Jul 15 14:42 - 15:16 (00:34) > > reboot system boot Wed Jul 15 14:37 (01:04) > > vmarko pts/1 Wed Jul 15 13:38 - crash (00:58) > > reboot system boot Wed Jul 15 13:36 (02:04) > > reboot system boot Wed Jul 15 12:36 (03:05) > > reboot system boot Wed Jul 15 11:35 (04:05) > > reboot system boot Wed Jul 15 10:38 (05:02) > > reboot system boot Wed Jul 15 09:34 (06:06) > > reboot system boot Wed Jul 15 08:34 (07:07) > > reboot system boot Wed Jul 15 07:33 (08:07) > > reboot system boot Wed Jul 15 06:33 (09:08) > > reboot system boot Wed Jul 15 05:32 (10:08) > > reboot system boot Wed Jul 15 04:32 (11:09) > > reboot system boot Wed Jul 15 03:31 (12:09) > > reboot system boot Wed Jul 15 02:31 (13:10) > > reboot system boot Wed Jul 15 01:30 (14:10) > > reboot system boot Wed Jul 15 00:30 (15:10) > > reboot system boot Tue Jul 14 23:30 (16:11) > > reboot system boot Tue Jul 14 22:29 (17:11) > > reboot system boot Tue Jul 14 21:29 (18:12) > > reboot system boot Tue Jul 14 20:28 (19:12) > > reboot system boot Tue Jul 14 19:28 (20:13) > > reboot system boot Tue Jul 14 18:27 (21:13) > > reboot system boot Tue Jul 14 17:27 (22:14) > > reboot system boot Tue Jul 14 16:26 (23:14) > > vmarko pts/1 Tue Jul 14 15:39 - 15:42 (00:03) > > reboot system boot Tue Jul 14 15:26 (1+00:15) > > vmarko pts/1 Tue Jul 14 15:11 - crash (00:14) > > ljubica pts/1 Tue Jul 14 14:26 - 15:11 (00:44) > > ljubica :0 Tue Jul 14 14:26 - 14:54 (00:27) > > ljubica :0 Tue Jul 14 14:26 - 14:26 (00:00) > > reboot system boot Tue Jul 14 14:25 (1+01:15) > > ljubica pts/2 Tue Jul 14 13:27 - 13:27 (00:00) > > ljubica pts/1 Tue Jul 14 13:27 - crash (00:58) > > ljubica :0 Tue Jul 14 13:27 - crash (00:58) > > ljubica :0 Tue Jul 14 13:27 - 13:27 (00:00) > > reboot system boot Tue Jul 14 13:25 (1+02:16) > > ljubica pts/1 Tue Jul 14 12:48 - crash (00:36) > > ljubica :0 Tue Jul 14 12:48 - crash (00:36) > > ljubica :0 Tue Jul 14 12:48 - 12:48 (00:00) > > reboot system boot Tue Jul 14 12:41 (1+02:59) > > ljubica pts/1 Tue Jul 14 11:45 - crash (00:55) > > >From the last log it looks like user "ljubica" did something that was > causing his session to crash, then he did something to cause the > server to reboot every hour. I would ask him/her what was done, it may > be operator error on his/her part. > > -Ross > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20090717/21e29057/attachment-0005.html>