Figuring out why computer rebooted itself?

Hi

My computer rebooted itself when I was away a few hours ago. I’m trying to figure out how but running out of my limited “expertise”.

last reboot
reboot system boot 5.12.16-1-MANJAR Fri Jul 30 12:37 still running
reboot system boot 5.12.16-1-MANJAR Wed Jul 14 22:22 still running
Not sure why the 2nd old session is “still running” ? Does this mean there’s not been a shutdown since?

Except there has been:
ast -x|grep shutdown | head -1
shutdown system down 5.12.9-1-MANJARO Wed Jul 14 22:22 - 22:22 (00:00)

Tried to install acct so this would work:
lastcomm | egrep ‘reboot|shutdown’
bash: lastcomm: command not found
Pacman can’t find acct or psacct despite it being on the AUR
and the kernel supporting it:
zcat /proc/config.gz | grep ACCT
CONFIG_BSD_PROCESS_ACCT=y
IIRC there’s some way of viewing the journal to see why it rebooted?
Is there a way to just print the journal to a file so I can view it in mousepad rather than the terminal?

Thanks

found some hardware errors but they don’t seem to be the cause

Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: Machine check events logged
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 3: eaa0000000070118
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: TSC 0 MISC d0160abf00000000 SYND 4d000030 IPID 300b000000000
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: PROCESSOR 2:870f10 TIME 1627645066 SOCKET 0 APIC 5 microcode 8701021
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: Machine check events logged
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 6: b48b5a0acd63955d
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: TSC 0 SYND 4d000030 IPID 600b000000000
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: PROCESSOR 2:870f10 TIME 1627645066 SOCKET 0 APIC 5 microcode 8701021
Jul 30 12:37:49 xxx kernel: #9 #10 #11

You can see the log from the last boot with
journalctl -e -b -1 (with -1 meaning the last boot, the current one would be 0)

(the -e automatically scrolls down to the end)

1 Like

So no real information? Just that it rebooted. So one would guess something like someone hitting the reset button? Not someone remotely rebooting it? Just trying to rule out rootkit etc really. I run rootkit scans every so often but I’m more security conscious lately due to CyberPolygon.
Jul 30 12:36:00 xxx kernel: [UFW BLOCK] IN=enp34s0 OUT= MAC=01:00:5e:00:00:01:dc:15:c8:1c:de:b3:08:00 SRC=192.168.178.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=31012 DF PROTO=2
– Boot 9378597e1a6246aaafe69aabfbdc9d14 –
Jul 30 12:37:49 xxx kernel: Linux version 5.12.16-1-MANJARO (builduser@LEGION) (gcc (GCC) 11.1.0, GNU ld (GNU Binutils) 2.36.1) #1 SMP PREEMPT Sun Jul 11 13:23:34 UTC 2021

The journal should be full of entries.

Also, please put the terminal output into code tags by clicking the “preformatted text” button (or ctrl+shift+c).

systemd should log when it shuts down the system. If you don’t have such log, it may be hardware related, like a hard shutdown or an electrical fault.

If that is actually the last entry of the previous boot, then I suggest that a power outage killed everything.