Ubuntu 18.04 Host rebooting frequently

Asked by Dilip B R on 2021-03-17

Ubuntu 18.04 Host rebooting frequently which we're using it as Development Machine.
On Feb 25th at 03:00 AM host rebooted but found no RCA.
Today Mar 17th, 03:00 AM host again rebooted, found some messages for reboot with some cronjobs but didnt find any cronjobs scheduled on this host.
Could you help me this.
# uptime
 15:15:33 up 12:15, 2 users, load average: 0.00, 0.05, 0.07

/# date
Wed Mar 17 15:15:34 CET 2021

# crontab -l
no crontab for root

# last reboot
reboot system boot 4.15.0-137-gener Wed Mar 17 03:00 still running

Mar 17 03:00:28 test-dev cron[1333]: (CRON) INFO (pidfile fd = 3)
Mar 17 03:00:28 test-dev cron[1333]: (CRON) INFO (Running @reboot jobs)
Mar 17 03:00:28 test-dev apport[1336]: * Starting automatic crash report generation: apport
Mar 17 03:00:28 test-dev systemd[1]: Starting OpenBSD Secure Shell server...
Mar 17 03:00:28 test-dev systemd[1]: Starting System Logging Service...
Mar 17 03:00:28 test-dev kernel: [ 1.483586] Freeing unused kernel image memory: 2440K

Mar 17 02:55:00 test-dev systemd-logind[1217]: Creating /run/nologin, blocking further logins...
Mar 17 02:55:01 test-dev CRON[29753]: pam_unix(cron:session): session opened for user root by (uid=0)
Mar 17 02:55:01 test-dev CRON[29753]: pam_unix(cron:session): session closed for user root
Mar 17 03:00:00 test-dev systemd-logind[1217]: System is rebooting.
Mar 17 03:00:28 test-dev systemd-logind[1325]: New seat seat0.
Mar 17 03:00:28 test-dev systemd-logind[1325]: Watching system buttons on /dev/input/event0 (Power Button)
Mar 17 03:00:28 test-dev systemd-logind[1325]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard)

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:

have you checked auth.log and the output of:

last | head

Does it always reboot at 3am ?

Dilip B R (dilip-br) said : #2

Mar 17 02:55:00 test-dev systemd-logind[1217]: Creating /run/nologin, blocking further logins...
Mar 17 02:55:01 test-dev CRON[29753]: pam_unix(cron:session): session opened for user root by (uid=0)
Mar 17 02:55:01 test-dev CRON[29753]: pam_unix(cron:session): session closed for user root
Mar 17 03:00:00 test-dev systemd-logind[1217]: System is rebooting.
Mar 17 03:00:28 test-dev systemd-logind[1325]: New seat seat0.
Mar 17 03:00:28 test-dev systemd-logind[1325]: Watching system buttons on /dev/input/event0 (Power Button)
Mar 17 03:00:28 test-dev systemd-logind[1325]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard)

This is the auth.log output

last | head shows host rebooted 17Mar2021

Does it always reboot at 3am ? No
Last time (25th Feb) unexpected reboot happened but we didnt get any RC.
Host again rebooted this morning at same time 03:00 AM, no cron jobs found.

Is the server a VM and/or are there any agents on there that can send messages to the OS?

Dilip B R (dilip-br) said : #4

It's a VM
We're rapid 7 agent and crowdstrike agent which is used for vulnerability check and security purpose.

Any scheduled tasks in vsphere?

Dilip B R (dilip-br) said : #6

No

Can you help with this problem?

Provide an answer of your own, or ask Dilip B R for more information if necessary.

To post a message you must log in.