Analyzing Unexpected Shutdown of Ubuntu Cloud Server

Ideally one should everyday login to Ubuntu server running WordPress like software. Public internet has been dangerous and hackers known to perform various kind of practice. It is not great get astonished by an unexpected shutdown of cloud server in clueless manner.

Overheating a common issue for the dedicated servers while cloud Server instances commonly have the issue of operating system related failure of “forced upgrade” resulting dumb, mute server. Many start with Ubuntu as they feel it is easy but time push everyone towards becoming semi-expert and to shift to REHL or CentOS like production grade server operating systems.

Programs root privileged programs can gracefully shutdown an operating system. Either a humane user with root privileges or an acpi script can do that job. In either cases we can find out the reason by checking the logs. Overheating a common issue for the dedicated servers. An acpi shutdown can be caused by power button press, overheating. Virtual and cloud have virtual buttons on control panel. Someone can login to your control panel to shut down the instance.

Not always system have the chance to save logs. But monitoring logs, graphs of the system will show load average charting, other matters which can indicate the scence.

 

How To Examine Unexpected Shutdown of Cloud Server From SSH

 

You must SSH as fast you detected such scene. Hackers love to add scripts via crontab, so check it :

Usually /var/log will tell the time the machine was shut down but not the initial reason, it will be like :

Command can be like :

Check the following log files with the keyword shutdown :

Of course there are commands to check :

Display list of last reboot entries:

Display list of last shutdown entries:

or

This is a normal shutdown :

This kind of keywords in log :

probably some software performed orderly shutdown. Run these :

Rsyslog hanged this server inviting shutdown :

Removing it will fix the problem as emergency measure. Why it acted oddly requires research. Hacker’s altered script can fake odd behavior. Is such hanging by rsyslog happened to the others? Web search saying yes. So, it was probably not out of intrusion.

There is a good old article on this topic :

We hope, Ubuntu users conclude reason of shutdown to this (and not an intrusion) :

You can talk with your host. The thing is not good if repeats twice. Result with no backup can be sucking thumb.

This Article Has Been Shared 5201 Times!

Facebook Twitter Google+ Pinterest