Figuring out why computer rebooted itself?

Support
1

Hi

My computer rebooted itself when I was away a few hours ago. I’m trying to figure out how but running out of my limited “expertise”.

last reboot
reboot system boot 5.12.16-1-MANJAR Fri Jul 30 12:37 still running
reboot system boot 5.12.16-1-MANJAR Wed Jul 14 22:22 still running
Not sure why the 2nd old session is “still running” ? Does this mean there’s not been a shutdown since?

Except there has been:
ast -x|grep shutdown | head -1
shutdown system down 5.12.9-1-MANJARO Wed Jul 14 22:22 - 22:22 (00:00)

Tried to install acct so this would work:
lastcomm | egrep ‘reboot|shutdown’
bash: lastcomm: command not found
Pacman can’t find acct or psacct despite it being on the AUR
and the kernel supporting it:
zcat /proc/config.gz | grep ACCT
CONFIG_BSD_PROCESS_ACCT=y
IIRC there’s some way of viewing the journal to see why it rebooted?
Is there a way to just print the journal to a file so I can view it in mousepad rather than the terminal?

Thanks

2

found some hardware errors but they don’t seem to be the cause

Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: Machine check events logged
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 3: eaa0000000070118
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: TSC 0 MISC d0160abf00000000 SYND 4d000030 IPID 300b000000000
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: PROCESSOR 2:870f10 TIME 1627645066 SOCKET 0 APIC 5 microcode 8701021
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: Machine check events logged
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: CPU 8: Machine Check: 0 Bank 6: b48b5a0acd63955d
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: TSC 0 SYND 4d000030 IPID 600b000000000
Jul 30 12:37:49 xxx kernel: mce: [Hardware Error]: PROCESSOR 2:870f10 TIME 1627645066 SOCKET 0 APIC 5 microcode 8701021
Jul 30 12:37:49 xxx kernel: #9 #10 #11

3

You can see the log from the last boot with
journalctl -e -b -1 (with -1 meaning the last boot, the current one would be 0)

(the -e automatically scrolls down to the end)

1 Like
4

So no real information? Just that it rebooted. So one would guess something like someone hitting the reset button? Not someone remotely rebooting it? Just trying to rule out rootkit etc really. I run rootkit scans every so often but I’m more security conscious lately due to CyberPolygon.
Jul 30 12:36:00 xxx kernel: [UFW BLOCK] IN=enp34s0 OUT= MAC=01:00:5e:00:00:01:dc:15:c8:1c:de:b3:08:00 SRC=192.168.178.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=31012 DF PROTO=2
– Boot 9378597e1a6246aaafe69aabfbdc9d14 –
Jul 30 12:37:49 xxx kernel: Linux version 5.12.16-1-MANJARO (builduser@LEGION) (gcc (GCC) 11.1.0, GNU ld (GNU Binutils) 2.36.1) #1 SMP PREEMPT Sun Jul 11 13:23:34 UTC 2021

5

The journal should be full of entries.

Also, please put the terminal output into code tags by clicking the “preformatted text” button (or ctrl+shift+c).

6

systemd should log when it shuts down the system. If you don’t have such log, it may be hardware related, like a hard shutdown or an electrical fault.

1 Like
7

If that is actually the last entry of the previous boot, then I suggest that a power outage killed everything.

8