# Step 1 — Check the Systemd Journal

Linux logs most events in the systemd journal.

sudo journalctl -b -1

Explanation:

• -b -1 → shows logs from the previous boot

• Look for error, failed, or panic messages

Common keywords to search:

sudo journalctl -b -1 | grep -i "error"
sudo journalctl -b -1 | grep -i "fail"
sudo journalctl -b -1 | grep -i "panic"

---

## Step 2 — Check /var/log/syslog or /var/log/messages

These are standard system logs for Debian/Ubuntu and CentOS/RHEL.

sudo tail -n 50 /var/log/syslog       # Debian/Ubuntu
sudo tail -n 50 /var/log/messages     # CentOS/RHEL

Look for:

• Kernel panics

• Service crashes

• Out-of-memory events

• Hardware errors

• 
  

---

## Step 3 — Check Kernel Logs

Kernel issues can cause sudden reboots.

sudo dmesg | less

Search for:

• panic → kernel panic

• oom → out-of-memory

• error → hardware or driver issues

---

## Step 4 — Check Specific Service Logs

If a service crash causes the server to restart (less common), check:

• Nginx: /var/log/nginx/error.log

• MySQL: /var/log/mysql/error.log

• Apache: /var/log/apache2/error.log

Example:

sudo tail -n 50 /var/log/mysql/error.log

---

## Step 5 — Check Hardware Logs (if VPS or Bare Metal)

• VPS: Check provider’s control panel for hardware errors

• Bare Metal: Use ipmitool or server management interface for:

• sudo ipmitool sel list
  

• Look for temperature warnings, PSU failures, or ECC memory errors

• 
  

---

## Step 6 — Check Swap and Memory Usage

Sometimes OOM (Out of Memory) triggers a reboot.

free -h
sudo journalctl -b -1 | grep -i "oom"

High memory usage or repeated OOM events → optimize applications or increase RAM.

---

## Step 7 — Check Disk Space

Full disks can cause system instability:

df -h
sudo journalctl -b -1 | grep -i "disk"

Clear space in /var/log, /tmp, or /home if needed.

---

## Step 8 — Check Scheduled Reboots or Cron Jobs

A misconfigured cron job may reboot the server:

sudo crontab -l
sudo cat /etc/crontab
sudo ls /etc/cron.*

Look for commands like:

• reboot

• shutdown -r now

---

## Step 9 — Check Boot Loader and Startup Scripts

• Examine /etc/rc.local for unexpected commands

• Check boot loader logs:

sudo cat /boot/grub/grub.cfg

• Misconfigured init scripts or services may trigger a restart

• 
  

---

## Step 10 — Prevent Future Sudden Restarts

• Set up monitoring:

  • Glances

  • Netdata

  • Prometheus + Grafana

• Configure alerting for:

  • High CPU, memory, disk usage

  • Service crashes

  • Kernel panics

• Backup logs regularly for post-mortem analysis

• 
  

---

## Beginner-Friendly Checklist

---

## Conclusion

A server that keeps restarting is alarming, but careful log checking helps identify the root cause:

• Start with systemd journal and syslog/messages

• Check kernel logs for panic or OOM events

• Look at service-specific logs

• Investigate hardware errors if bare metal

• Verify disk space and cron jobs

Following these steps, even beginners can systematically figure out why the server is restarting and take appropriate action.