How can I find out what happened to my Debian box?

Question

I have an old PC lying around which I've installed Debian 6.0 on. Last night I was trying to SSH in and it wouldn't respond so I pressed the reset button. How can I find out what happened to it? It seems fine now.

Answer 1

Assuming your computer is usually stable, check for hardware problems, especially with the RAM (i.e. install memtest86+ and choose memtest at the boot prompt), but also with disks (disk errors sometimes crash the filesystem code; install smartmontools and run smartctl -a /dev/sda). If the problem was gradual, you may find something in the kernel logs (/var/log/kern.log), but often the crash happens too brutally for anything to be written to the logs.

Answer 2

By this -

How can I find out what happened to it?

I presume you want to know what happened during your failed attempt at SSH!

One place to look into will be /var/log. Something like grep -ir ssh /var/log/* should give you the SSH related log entries.

Answer 3

Reading the .1 logs is always a good place to start.

Use iptraf to see if your machine makes any suspisious connections (if someone got/has unauthorized access).

Run a rkhunter scan:
aptitude install rkhunter
rkhunter --update
rkhunter --check

And should it ever happen again, attach a monitor and see what the console says :)