How do I inspect the previous boot after a Linux server restarts unexpectedly?
The systemd journal can separate messages by boot. Use the boot list to confirm what is retained before requesting the previous boot. If logging was volatile or records were rotated away, the server may no longer hold the evidence needed to explain the restart.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. List the retained boots
Each listed boot has an identifier and recorded time range. Confirm that the previous boot corresponds to the incident, especially after several short restart attempts.
sudo journalctl --list-boots --no-pagerThe list only covers journals available to the command; it is not a complete lifetime reboot history.
2. Read warnings from the prior boot
Begin with a bounded warning-or-higher excerpt, then review surrounding normal messages when needed to understand shutdown order.
sudo journalctl -b -1 -p warning -n 100 --no-pager-b -1 selects the previous retained boot. An abrupt end can be consistent with power loss or a crash but does not prove either cause.
Check the result
- The selected boot and timestamps match the incident. Correlate OS evidence with provider console, hypervisor or hardware events before attributing the cause.
Troubleshooting
- The previous boot is unavailable
- Inspect retention and persistent-journal configuration for future incidents. Do not claim missing historical logs have been recovered.
- Warnings exist but no shutdown cause is recorded
- Check external power/reset events and kernel crash evidence; a forced reset can prevent final messages from being written.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.