This morning I found the machine not running. Last Friday night everything was still running. I'm trying to find out what happened.
I've had a look at "last" – besides the enigmatic "crashes" of last Wednesday there's nothing weird there. (no clue what those are either)
me pts/0 :0.0 Mon Oct 29 08:42 still logged in
reboot system boot 3.5.6-1-ARCH Mon Oct 29 08:41 - 08:49 (00:07)
me pts/1 :0.0 Wed Oct 24 18:37 - crash (4+15:04)
me pts/0 :0.0 Wed Oct 24 16:36 - crash (4+17:05)
reboot system boot 3.5.6-1-ARCH Wed Oct 24 16:36 - 08:49 (4+17:13)
me pts/0 :0.0 Wed Oct 24 16:34 - 16:34 (00:00)
The last entries in the logs date from this morning "Oct 29 07:28:12". The next entries are those of me rebooting the system. I think that excludes the winter time change of last Sunday at 3 AM.
Is there anyplace else I can look for clues ?
Best Answer
You should check in /var/log the files syslog, messages, dmesg, daemon.log, auth.log (there might be versions of them with .0/.1/.2.gz/.. append which will tell you even more what happened in the last time. (The extensions of these files will depend on your logrotate settings). Generally you could check all files in /var/log but the mentioned file are those that most likely contain relevant information.