How to investigate a system crash

I was wondering if there's a way to get further information regarding a system crash.
For instance after issuing the following command last -x | grep crash I get the following output:

Tue May 22 04:01 - crash  (00:08)

investigating further on that particular date and time journalctl -b -1, it seems that nothing has been logged in regarding the crash. Also let me add that during the crash the system rebooted.

Are there any other commands that will allow us to further investigate what actually caused the crash? Where should we look other than the logs?

Thanks in advance!

How did you came up to this command?

Usage:
 last [options] [<username>...] [<tty>...]

Show a listing of last logged in users

I guess that the last logged lines should be what you need to investigate.

last -x is related to system output i.e. this is reboots, shutdowns and then from there you filter for any crashes.

I did check but it's nothing there, could that be because the system rebooted and didn't log anything indicating the cause of the crash?

1 Like

Not always present in that report I assume..

That's why I said "look for the last logged..". You may or may not recognize the relation. However, when you want to get help on that, you should start a topic with that.
You may find this helpful.
Also our own Tutorial

1 Like

Thanks for the link, if you don't mind me asking a sub-question? In the logs I see this random: 7 urandom warning(s) missed due to ratelimiting
is this ratelimiting related to the rate limit of journald or is it sth else?
Because I've tried increasing the rate limit of logs /etc/systemd/journald.conf but nothing happens I still get this message after every boot.

I even tried this but I still get the same warning after every reboot.

I don't know. But your OT was about general troubleshooting.
Why don't you

and leave this topic clean?

This shows log from previous boot. Maybe you should try -2 or -3 etc

From journalctl --help

     --disk-usage            Show total disk usage of all journal files
     --vacuum-size=BYTES     Reduce disk usage below specified size

If you want to see only the last error lines from the previous boot: journalctl -xe -p3 -b-1

@kirk
The ratelimiting for me was due to entropy being too low. Is haveged installed?

https://wiki.archlinux.org/index.php/Haveged

@ryanmusante Thanks for that info, I just learned sth new today. Apparently as it seems haveged is already installed.

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.

Forum kindly sponsored by