How do I see who is rebooting my Linux server?

3 answers. You can use "last" to check. Shows when the system was rebooted and who logged in and out. If your users have to use sudo to restart the server, then you should be able to find out who did it by looking in the relevant log file.

How do you check who was last rebooted in Linux?

Use the who command to find the time/date of the last system reboot

the the last command searches the file /var/log/wtmp and displays a list of all connected (and disconnected) users since that file was created. The pseudo user reboot logs in every time the system is rebooted.

How do I investigate a Linux server reboot?

You can further correlate the reboot you want to diagnose with system messages. For CentOS/RHEL systems, you will find the logs in /var/log/messages while for Ubuntu/Debian systems, it logs to /var/log/syslog. You can simply use the tail command or your favorite text editor to filter or find specific data.

How do you check if a server has been restarted?

Follow these steps to check the last restart via command prompt:

  1. Open Command Prompt as administrator.
  2. At the command line, copy and paste the following command and press Enter: systeminfo | find /i "Boot time"
  3. Should Watch the last time your PC was restarted.

How do I find out why Ubuntu rebooted?

2 answers. Check /var/log/auth. Log in to see what was going on at the time of the incident. Also try checking /var/log/messages or /var/log/syslog, as these may show that the server's restart button was pressed.

What are the 6 runlevels in Linux?

A runlevel is an operating state in a Unix-based operating system and a Unix that is defaulted in the Linux-based system. The runlevels are numbered from zero to six.


Runlevel 0 turn off the system
Runlevel 5 multiuser mode with network
Runlevel 6 reboot the system to restart it

How do I check the logs on Linux?

Linux logs can be viewed with the command cd/var/registry, then typing the ls command to view the logs stored in this directory. One of the most important logs to look at is the syslog, which logs everything except authentication-related messages.

How do I check if a Linux server is down?

Check running services on Linux

  1. Check the status of the service. A service can have any of the following states: …
  2. Start the service. If a service is not running, you can use the service command to start it. …
  3. Use netstat to find port conflicts. …
  4. Check the status of xinetd. …
  5. Check the logs. …
  6. Next steps.

How do I find out why my Linux server is down?

How to Troubleshoot When Your Site Is Down on a Linux Server

  1. Step 1: Check the status of the server. …
  2. Step 2: Monitoring your server. …
  3. Step 3 – Check the logs. …
  4. Step 4 – Make sure your web server is up and running. …
  5. Step 5: Check the web server syntax. …
  6. Step 6: Is your database back-end working fine?

How do I know if my Linux server is crashing?

How to diagnose why your Linux server crashed?

  1. Linux process management. Upper part. …
  2. Analyze network traffic. Occasionally a server crash will be triggered due to problems with network traffic. …
  3. Check the logs. When all else fails, reviewing your server logs is one of the best ways to troubleshoot any errors.

How can I find out why my server was restarted?

How to find out who restarted Windows Server

  1. Login to the Windows server.
  2. Start Event Viewer (type eventvwr in run).
  3. In the event viewer console, expand Windows Logs.
  4. Click System, and in the right pane, click Filter Current Log.

What event ID is a reset?

Event ID 41: The system restarted without cleanly shutting down first. This error occurs when the system stops responding, crashes, or loses power unexpectedly. Event ID 1074 – Logged when an application (such as Windows Update) causes the system to reboot, or when a user initiates a reboot or shutdown.

How do I find out why my server is down?


  1. Go to Event Viewer.
  2. Right click on the system and -> Filter Current Log.
  3. For user closures, click the Event Sources -> Verify User32 down arrow.
  4. In type 1074 -> OK.

#rebooting #Linux #server

You may also like...