Start by establishing when the machine restarted, then inspect the journal from the boot immediately before the current one. On a systemd system, run who -b, last -x | head -30, journalctl -b -1 -e, and journalctl -b -1 -k. These commands can reveal an orderly shutdown, a kernel error, or the point where records stopped—but a missing final message does not prove what caused the reboot.
1. Establish when the reboot happened
Begin with a timeline so you know which boot and time window to investigate. Run:
who -b
last reboot
last -x | head -30who -b reports the last system boot time. last reboot lists recorded reboots; last -x also includes shutdown and runlevel transitions. The records may be incomplete, so treat them as a starting point rather than an authoritative incident log.
Note the likely incident time and timezone. Compare it with timestamps in the system journal, authentication and audit records, scheduled-job logs, cloud-provider events, and external monitoring. Logs can use different timezones or formats; align them before deciding that two events occurred together. A timeline narrows the search but does not by itself establish a cause.
#1 Best Overall
2. Inspect the preceding boot’s journal
On a systemd machine, list the boots retained in the journal and inspect the end of the previous one:
journalctl --list-boots
journalctl -b -1 -e
journalctl -b -1 -k-b -1 selects the boot before the current boot. -e moves to the end of that boot’s records, while -k limits output to kernel messages. Read more than just the final line: an error or warning earlier in the boot may matter, and the last surviving message may simply be the last thing logged before records stopped.
To narrow a large journal to a known time window, use --since and --until, supplying times appropriate to the incident:
journalctl -b -1 --since "2026-09-28 13:00:00" --until "2026-09-28 14:00:00"Adjust the example dates and times to your incident. Review system and kernel messages around the window, then correlate any suspicious entries with independent records. Do not conclude that a service caused the reboot just because its message happens to be the final entry.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →3. Decide whether the shutdown was orderly or abrupt
A recorded shutdown or reboot sequence is a useful lead. Look for a deliberate system shutdown in the journal and correlate its time with user sessions, authentication logs, audit records, and scheduled work. Check cron jobs, at jobs, and systemd timers if automation could have requested a restart.
Audit records may help identify who invoked a command, but only if auditing and suitable rules were configured and records were retained before the incident. Shell history can suggest what an administrator ran, but it is not a reliable audit trail: commands may be absent, altered, or associated with the wrong session.
If the journal ends without a clean shutdown sequence, that is consistent with a crash, lockup, reset, or power interruption. It does not distinguish between them. The machine may have stopped before it could write a final explanation, so an abrupt ending is evidence about what records survived—not proof of a specific failure.
4. Check for kernel crash evidence
If a kernel panic or hang is plausible, inspect any crash dumps and distribution-provided crash tools that were configured on the machine. A dump may preserve details unavailable in ordinary logs, but crash collection generally needs to be set up before the incident and enough storage must be available.
Red Hat’s guidance for unexpected reboots on RHEL specifically recommends reviewing kdump output. It cautions that if kdump was not installed and configured before the reboot, it may not be possible to determine the cause. That guidance is RHEL-specific; configuration steps and tooling differ across distributions. Kdump also cannot explain every event—for example, a power outage or an intentional reboot may leave no relevant dump.
5. Investigate watchdog and hardware resets
A watchdog can reset a system that appears stuck. Some Linux watchdog drivers expose status or boot-status information that may point to watchdog resets, overheating, fan failures, or power conditions. Support depends on the particular hardware and driver; not all devices provide these status calls. Check the documentation for the machine and driver before treating missing status as evidence that no hardware event occurred.
For suspected hardware or platform resets, inspect firmware records, a management controller’s event log, or other platform diagnostics if the machine provides them. These sources may record events that were never visible to the guest operating system.
A serial console can capture boot diagnostics when the machine cannot provide a normal shell or its saved logs are insufficient. It requires a compatible serial console on the platform; verify the connector, electrical levels, and machine documentation before choosing an adapter. systemd’s boot-debug options and serial-console approaches can help with future captures, but a console cannot recover output that was never recorded during a past incident.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute6. If the machine is a cloud VM, check provider records
Guest logs do not expose every host or control-plane event. For Google Compute Engine, correlate the VM’s guest timeline with Cloud Audit Logs and system-event records. Google documents event types including host errors, automatic restart, guest termination, maintenance-related termination, and preemption. These event names and the query below are specific to GCP; other providers have their own consoles, event records, and terminology.
Google’s example query reads recent activity. Replace VM_NAME and change the time window to match the incident:
gcloud logging read --freshness=1h 'resource.type="gce_instance" "VM_NAME" logName:("logs/cloudaudit.googleapis.com%2Fsystem_event" OR "logs/cloudaudit.googleapis.com%2Factivity")'In the returned records, review the method and principalEmail fields where present. They can help distinguish an operator or API action from a platform event. Compare provider timestamps with the guest’s journal rather than assuming the VM’s final guest log explains a host-side restart.
Rank #4
7. Match evidence to likely causes
| Candidate explanation | Evidence to seek | What the evidence can establish |
|---|---|---|
| Intentional command or automation | Shutdown sequence, authentication or audit record, cron or at job, systemd timer |
A recorded request or scheduled action may identify an actor or automation path; incomplete logging leaves uncertainty. |
| Kernel panic or hang | Kernel journal messages, a configured crash dump, serial-console capture | These may document a kernel failure, but missing capture does not rule one out. |
| Watchdog, thermal, or power reset | Watchdog status, firmware or management-controller event log | Device-specific status may identify a reset reason; support varies by hardware and driver. |
| Cloud control-plane or host event | Provider audit and system-event records correlated with guest timestamps | Provider-side records can reveal actions or platform events absent from guest logs. |
| Cause not recoverable from retained records | Missing prior journal, no configured crash capture, or abrupt loss of power | The honest conclusion may be that the retained evidence cannot confirm the cause. |
8. Why the previous boot may be missing—and how to preserve the next one
If journalctl --list-boots does not show the expected boot, check the journal’s storage mode and distribution configuration before concluding there was no relevant event. systemd-journald can store records persistently under /var/log/journal or temporarily under /run/log/journal. Volatile records in /run are lost at reboot. Persistent storage must be enabled before an incident to retain the previous boot’s journal; it cannot recreate records already lost.
For future incidents, make sure the journal retention mode suits the machine, configure the distribution’s crash-dump mechanism if kernel failures are a concern, and verify that dump storage is adequate. Cloud operators should retain relevant audit and system-event logs and correlate them with guest monitoring. If hardware resets are difficult to capture, consider a supported serial console or an external monitoring source. These measures improve the chance of preserving evidence; none guarantees that every power or hardware event will be recorded.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common troubleshooting cases
journalctl -b -1 says there is no previous boot
Run journalctl --list-boots to see what is retained. If only the current boot appears, check whether journald used volatile storage under /run/log/journal or whether the relevant records have otherwise expired. Changing storage now helps future incidents, not the one whose records are gone.
The journal stops suddenly but has no error
Do not assign cause based on the final message. An abrupt end is consistent with several failure modes, including power loss and reset. Compare the timeline with audit, provider, hardware, and monitoring records; if those are unavailable, state that the cause cannot be confirmed from retained evidence.
There is no crash dump
Crash collection may not have been configured before the event, may not apply to the failure mode, or may lack usable storage. Check the distribution-specific setup and any available crash records. A missing dump cannot establish that no kernel problem occurred.
Recommended Free Tools
Best Value
Guest records do not explain a cloud restart
Check the provider’s audit and system-event records for the same VM and time window. On GCP, inspect the documented audit fields and event records; do not apply GCP event names or query syntax to another cloud provider.
Or skip the browser setup
ScreenshotNeo is a website screenshot API, not a Linux reboot-diagnosis tool, so it does not replace the commands or evidence checks above. If you separately need a clean screenshot of a web page, one GET request can return an image or PDF. Cookie banners, popups, and chat widgets are removed before the shot; bot checks, blank pages, and failed loads are not billed; and an MCP server lets AI agents take screenshots. It includes 1,000 screenshots a month free with no card, and paid plans start at $5 for 3,000. See the ScreenshotNeo site and API documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSign up for ScreenshotNeo’s free plan: 1,000 screenshots a month, no card required.
Frequently Asked Questions
Does a missing shutdown message mean the server lost power?
No. It is compatible with power loss, but also with a crash, lockup, or reset; the absence of a clean shutdown record does not distinguish those causes.
Can I recover a previous boot’s volatile journal after reboot?
No. Records stored only under /run/log/journal are temporary and are lost at reboot. Persistent journal storage has to be configured in advance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
