How to investigate a system crash

[kirk]

I was wondering if there's a way to get further information regarding a system crash.
For instance after issuing the following command last -x | grep crash I get the following output:

Tue May 22 04:01 - crash  (00:08)

investigating further on that particular date and time journalctl -b -1, it seems that nothing has been logged in regarding the crash. Also let me add that during the crash the system rebooted.

Are there any other commands that will allow us to further investigate what actually caused the crash? Where should we look other than the logs?

Thanks in advance!

[AgentS]

@kirk

last -x | grep crash

How did you came up to this command?

Usage:
 last [options] [<username>...] [<tty>...]

Show a listing of last logged in users

@kirk

investigating further on that particular date and time journalctl -b -1 , it seems that nothing has been logged in regarding the crash.

I guess that the last logged lines should be what you need to investigate.

[kirk]

@AgentS

How did you came up to this command?

last -x is related to system output i.e. this is reboots, shutdowns and then from there you filter for any crashes.

@AgentS

I guess that the last logged lines should be what you need to investigate.

I did check but it's nothing there, could that be because the system rebooted and didn't log anything indicating the cause of the crash?

[AgentS]

@kirk

filter for any crashes

Not always present in that report I assume..

@kirk

I did check but it’s nothing there, could that be because the system rebooted and didn’t log anything indicating the cause of the crash?

That's why I said "look for the last logged..". You may or may not recognize the relation. However, when you want to get help on that, you should start a topic with that.
You may find this helpful.
Also our own Tutorial

How to provide good information in your posts

When asking questions in the forum, it would be most helpful to all members if you provide some basic information. When you provide info from the terminal, usually from your logs, you have to format it so the content is easy to read. First copy and paste your text/terminal/code into the post Then select the text/code and click the post edit toolbar button </> . Another handy way is to use 3 backticks ` at the start and 3 more at the end of the text like this: ``` Paste text or code here …

[kirk]

Thanks for the link, if you don't mind me asking a sub-question? In the logs I see this random: 7 urandom warning(s) missed due to ratelimiting
is this ratelimiting related to the rate limit of journald or is it sth else?
Because I've tried increasing the rate limit of logs /etc/systemd/journald.conf but nothing happens I still get this message after every boot.

I even tried this but I still get the same warning after every reboot.

[AgentS]

@kirk

is this ratelimiting related to the rate limit of journald or is it sth else?

I don't know. But your OT was about general troubleshooting.
Why don't you

@AgentS

when you want to get help on that, you should start a topic with that.

and leave this topic clean?

[kainonergon]

@kirk

journalctl -b -1

This shows log from previous boot. Maybe you should try -2 or -3 etc

[AgentS]

@AgentS

is this ratelimiting related to the rate limit of journald or is it sth else?

I don’t know.

From journalctl --help

     --disk-usage            Show total disk usage of all journal files
     --vacuum-size=BYTES     Reduce disk usage below specified size

[mbb]

If you want to see only the last error lines from the previous boot: journalctl -xe -p3 -b-1

[ryanmusante]

@kirk
The ratelimiting for me was due to entropy being too low. Is haveged installed?

https://wiki.archlinux.org/index.php/Haveged

[kirk]

@ryanmusante Thanks for that info, I just learned sth new today. Apparently as it seems haveged is already installed.