Server rebooted unexpectedly. Now you need to figure out why. Here’s the checklist.

Check previous boot logs

The -b -1 flag shows logs from the boot before the current one:

sudo journalctl -b -1 -n 500 --no-pager

For just errors:

sudo journalctl -b -1 -p err

Look for OOM killer or kernel panic

sudo dmesg -T | grep -i "out of memory\|oom-killer\|panic\|hung\|blocked"

Also check syslog:

sudo grep -i "out of memory\|oom-killer" /var/log/syslog

Check for high load

If you have sysstat installed:

sar -q -f /var/log/sysstat/sa$(date +%d -d yesterday)

Reboot history:

last reboot

AWS-specific

sudo cat /var/log/cloud-init-output.log | tail -100

What to look for

  • OOM messages - memory exhaustion
  • High load averages in sar
  • Kernel panic messages
  • “task blocked for more than X seconds” - usually I/O or storage issues
  • Hardware or I/O errors
  • Network timeouts

The previous boot logs are the key. If journalctl shows nothing useful, the crash was likely hard enough that nothing got written - think power loss, kernel panic, or hardware failure.