Computer auto. “rebooted” - kernel panic? - how to investigate?

Grima · 2012-01-04 09:40:10

Hello!

I woke up this morning only to find that my computer seems to have “rebooted” automatically. I first thought that there had been a power cut while I was asleep, but it is only my computer that has been affected. Nothing else.

I've been looking for some answers as to why this happened. I'm guessing my computer froze and restarted itself? I've looked in different files in /var/log but can't seem to find anything related to this incident.

I'm wondering if I could get any pointers as to where to start looking. Obviously in /var/log I guess (?) but as I said, I can't seem to find anything (except earlier boots, and the boot this morning, but no error or the like).

Thanks.

ewaller · 2012-01-05 04:59:49

Well, Last night was Tuesday -- It is not a Windows machine, is it? (I jest)

Take a look at /var/log/everything.log. Go find the last place where syslog started (work backwards from the end and check the times of the log entrys)
Now, the lines before that? Did syslog shut down just before it started the last time?
If not, what happened just before the syslog start message?

Grima · 2012-01-05 10:40:26

ewaller wrote:

Well, Last night was Tuesday -- It is not a Windows machine, is it? (I jest)
Take a look at /var/log/everything.log. Go find the last place where syslog started (work backwards from the end and check the times of the log entrys)
Now, the lines before that? Did syslog shut down just before it started the last time?
If not, what happened just before the syslog start message?

Haha, no, not Windows! Arch Linux all the way.

I opened up /var/log/everything.log and did a search for syslog. It was started at 10:07 yesterday which was around the time that I first went to my computer.

Jan 4 10:07:48 localhost syslog-ng[809]: syslog-ng starting up; version='3.3.3'

There is a jump in the timestamp, that is stretching from around 09:30 to 10:07. The last thing in the log before my 10:07 entry is a (it seems) half-written log entry about UFW. Normally the UFW entries have the information IN, OUT, MAC, SRC, DST, LEN and so on. This entry, however, only has the first three and then all of a sudden (without a new line) it says “Initializing cgroup subsys cpuset” with a timestamp of 10:07.

Jan 4 09:32:27 localhost kernel: [241579.054446] [UFW BLOCK] IN=eth0 OUT= MAC=XX:XX:XX:XX:XX:XXJan 4 10:07:48 localhost kernel: [ 0.000000] Initializing cgroup subsys cpuset

I really can't find anything strange in the file. There was a cron job that was run (FlexGet checking RSS feeds) 5 minutes before the last entry, then some entries about UFW, and after that there's entries about the computer booting.

This doesn't feel software related, or am I wrong? I don't know enough about these things but sudden death and destruction without clues in everything.log feels like a computer problem? I really hope that isn't the case...

kokoko3k · 2012-01-05 12:22:09

linux can be configured to auto-reboot on kernel panics.
in /etc/sysctl.conf i've:
kernel.panic = 600
which means that i want the kernel to reboot after 600 seconds from the crash.
Check if you have something similar by:

cat /proc/sys/kernel/panic

if yes, try setting it to 0, that way at least you will be able to read the console messages on the screen.

Last edited by kokoko3k (2012-01-05 12:23:45)

Grima · 2012-01-05 17:01:59

kokoko3k wrote:

linux can be configured to auto-reboot on kernel panics.
in /etc/sysctl.conf i've:
kernel.panic = 600
which means that i want the kernel to reboot after 600 seconds from the crash.
Check if you have something similar by:
cat /proc/sys/kernel/panic 
if yes, try setting it to 0, that way at least you will be able to read the console messages on the screen.

It was, unfortunately, already set to 0 so it can't be due to that.

Thanks for your post though!

Grima · 2012-03-29 13:50:07

Same thing again. This time my everything.log is filled with this:

Mar 29 14:45:53 localhost kernel: [280439.870448] ------------[ cut here ]------------
Mar 29 14:45:53 localhost kernel: [280439.870449] WARNING: at net/ipv4/tcp_input.c:2887 tcp_ack+0x2037/0x2240()
Mar 29 14:45:53 localhost kernel: [280439.870450] Hardware name: System Product Name
Mar 29 14:45:53 localhost kernel: [280439.870451] Modules linked in: nls_cp437 vfat fat loop usb_storage uas ip6t_LOG xt_hl ip6t_rt nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT ipt_LOG xt_limit xt_tcpudp xt_addrtype xt_state ip6table_filter ip6_tables nf_conntrack_netbios_ns nf_conntrack_broadcast nf_nat_ftp nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack_ftp nf_conntrack iptable_filter ip_tables x_tables fuse snd_hda_codec_hdmi snd_hda_codec_analog nvidia(P) snd_hda_intel snd_hda_codec snd_hwdep snd_pcm joydev i7core_edac snd_page_alloc snd_timer snd iTCO_wdt edac_core soundcore processor sky2 evdev button pcspkr psmouse iTCO_vendor_support mxm_wmi asus_atk0110 sr_mod cdrom serio_raw i2c_i801 wmi i2c_core vboxdrv(O) aes_x86_64 cryptd aes_generic xts gf128mul dm_crypt dm_mod sd_mod usbhid hid uhci_hcd ahci libahci libata scsi_mod ehci_hcd usbcore usb_common ext4 crc16 jbd2 mbcache
Mar 29 14:45:53 localhost kernel: [280439.870476] Pid: 0, comm: swapper/0 Tainted: P        W  O 3.2.11-1-ARCH #1
Mar 29 14:45:53 localhost kernel: [280439.870477] Call Trace:
Mar 29 14:45:53 localhost kernel: [280439.870478]  <IRQ>  [<ffffffff810660af>] warn_slowpath_common+0x7f/0xc0
Mar 29 14:45:53 localhost kernel: [280439.870481]  [<ffffffff8106610a>] warn_slowpath_null+0x1a/0x20
Mar 29 14:45:53 localhost kernel: [280439.870482]  [<ffffffff813aef97>] tcp_ack+0x2037/0x2240
Mar 29 14:45:53 localhost kernel: [280439.870484]  [<ffffffff813aaf8c>] ? tcp_validate_incoming+0x10c/0x350
Mar 29 14:45:53 localhost kernel: [280439.870486]  [<ffffffff813affe0>] tcp_rcv_established+0x280/0x830
Mar 29 14:45:53 localhost kernel: [280439.870488]  [<ffffffff813b6f6d>] tcp_v4_do_rcv+0x10d/0x320
Mar 29 14:45:53 localhost kernel: [280439.870489]  [<ffffffff81375e65>] ? sk_filter+0x95/0xd0
Mar 29 14:45:53 localhost kernel: [280439.870491]  [<ffffffff813b9091>] tcp_v4_rcv+0x621/0x910
Mar 29 14:45:53 localhost kernel: [280439.870493]  [<ffffffff8139639d>] ip_local_deliver_finish+0xed/0x2b0
Mar 29 14:45:53 localhost kernel: [280439.870494]  [<ffffffff81396730>] ip_local_deliver+0x90/0xa0
Mar 29 14:45:53 localhost kernel: [280439.870496]  [<ffffffff81396061>] ip_rcv_finish+0x131/0x380
Mar 29 14:45:53 localhost kernel: [280439.870497]  [<ffffffff81396975>] ip_rcv+0x235/0x300
Mar 29 14:45:53 localhost kernel: [280439.870499]  [<ffffffff8105de5d>] ? ttwu_do_wakeup+0x3d/0x150
Mar 29 14:45:53 localhost kernel: [280439.870501]  [<ffffffff81362ed3>] __netif_receive_skb+0x573/0x630
Mar 29 14:45:53 localhost kernel: [280439.870503]  [<ffffffff8136366d>] netif_receive_skb+0xad/0xc0
Mar 29 14:45:53 localhost kernel: [280439.870504]  [<ffffffff81364060>] napi_skb_finish+0x50/0x70
Mar 29 14:45:53 localhost kernel: [280439.870506]  [<ffffffff81364175>] napi_gro_receive+0xf5/0x140
Mar 29 14:45:53 localhost kernel: [280439.870509]  [<ffffffffa0296ff3>] sky2_poll+0x693/0xcf0 [sky2]
Mar 29 14:45:53 localhost kernel: [280439.870511]  [<ffffffff813810c8>] ? sch_direct_xmit+0x68/0x1d0
Mar 29 14:45:53 localhost kernel: [280439.870512]  [<ffffffff81363949>] net_rx_action+0x149/0x300
Mar 29 14:45:53 localhost kernel: [280439.870514]  [<ffffffff8106d790>] __do_softirq+0xb0/0x270
Mar 29 14:45:53 localhost kernel: [280439.870516]  [<ffffffff8146002c>] call_softirq+0x1c/0x30
Mar 29 14:45:53 localhost kernel: [280439.870517]  [<ffffffff81017815>] do_softirq+0x65/0xa0
Mar 29 14:45:53 localhost kernel: [280439.870519]  [<ffffffff8106dc9e>] irq_exit+0x9e/0xc0
Mar 29 14:45:53 localhost kernel: [280439.870520]  [<ffffffff814608e3>] do_IRQ+0x63/0xe0
Mar 29 14:45:53 localhost kernel: [280439.870522]  [<ffffffff8145d52e>] common_interrupt+0x6e/0x6e
Mar 29 14:45:53 localhost kernel: [280439.870522]  <EOI>  [<ffffffff8108e52d>] ? notifier_call_chain+0x4d/0x70
Mar 29 14:45:53 localhost kernel: [280439.870525]  [<ffffffff8128f31d>] ? intel_idle+0xed/0x150
Mar 29 14:45:53 localhost kernel: [280439.870527]  [<ffffffff8128f2ff>] ? intel_idle+0xcf/0x150
Mar 29 14:45:53 localhost kernel: [280439.870528]  [<ffffffff81338bb1>] cpuidle_idle_call+0xc1/0x350
Mar 29 14:45:53 localhost kernel: [280439.870530]  [<ffffffff8101422e>] cpu_idle+0xce/0x120
Mar 29 14:45:53 localhost kernel: [280439.870532]  [<ffffffff81438032>] rest_init+0x96/0xa4
Mar 29 14:45:53 localhost kernel: [280439.870533]  [<ffffffff818c8c09>] start_kernel+0x3c4/0x3d1
Mar 29 14:45:53 localhost kernel: [280439.870535]  [<ffffffff818c8347>] x86_64_start_reservations+0x132/0x136
Mar 29 14:45:53 localhost kernel: [280439.870537]  [<ffffffff818c8140>] ? early_idt_handlers+0x140/0x140
Mar 29 14:45:53 localhost kernel: [280439.870539]  [<ffffffff818c844d>] x86_64_start_kernel+0x102/0x111
Mar 29 14:45:53 localhost kernel: [280439.870540] ---[ end trace 769647d211e58151 ]---
Mar 29 14:45:54 localhost kernel: [280440.740635] ------------[ cut here ]------------

Arch Linux

#1 2012-01-04 09:40:10

Computer auto. “rebooted” - kernel panic? - how to investigate?

#2 2012-01-05 04:59:49

Re: Computer auto. “rebooted” - kernel panic? - how to investigate?

#3 2012-01-05 10:40:26

Re: Computer auto. “rebooted” - kernel panic? - how to investigate?

#4 2012-01-05 12:22:09

Re: Computer auto. “rebooted” - kernel panic? - how to investigate?

#5 2012-01-05 17:01:59

Re: Computer auto. “rebooted” - kernel panic? - how to investigate?

#6 2012-03-29 13:50:07

Re: Computer auto. “rebooted” - kernel panic? - how to investigate?

Board footer