My Linux virtual machine reboots automatically without my interruptions. How do I know who rebooted the vm?

Question

Hi Team,

We created Linux Virtual machine and hosted our application inside the server.

everything working fine but last week my application went down so after my investigation, jar was killed because of Reboot happened inside the server.

How do I know who rebooted the vm?

please find the attached screenshot.Linux-server.png

Thanks & Regards,

Mahesh.Kattekola.

Answer 1

Hi Mahesh , Welcome to MS Q&A

• You can use the last command to see the reboot history

         last reboot
         
  

• The last command can also show you who was logged in at the time of the reboot:

    last
    
  

• If you have auditing enabled, you can check the audit logs for any user actions that might have triggered the reboot.

     ausearch -m SYSTEM_BOOT
     

Kindly check and let us know if any further questions

Please accept answers if it helps

Thanks

Deepanshu

Answer 2

Hi Deepanshukatara,

I am able to see inside the server below information (reboot happened on 28thJune2024)

reboot system boot 5.15.0-1067-azur Fri Jun 28 19:53 still running

reboot system boot 5.15.0-1064-azur Tue Jun 18 04:20 - 19:53 (10+15:33)

reboot system boot 5.15.0-1064-azur Tue Jun 11 10:43 - 04:20 (6+17:36)

reboot system boot 5.15.0-1064-azur Mon Jun 10 07:02 - 12:25 (05:22)

We think the reboot is due to guest patching inside the server.

Thanks & Regards,

Mahesh.Kattekola.