strange results from investigating a reboot in auth.log

Question

My Ubuntu 14.04 server is hosted on a well-known cloud provider.

I noticed today something that usually makes my heart stop:

user@myserver123:/var/log$ screen -ls
No Sockets found in /var/run/screen/S-user.

I confirmed there was a reboot Friday night (literally the worst time for a reboot to happen).

First I checked last:

reboot   system boot  3.16.0-31-generi Fri Jul 24 20:08 - 19:50 (3+23:42)   

wtmp begins Fri Jul 24 20:08:04 2015

Attempting to investigate I looked through /var/log/auth.log and found this:

Why all the ^@ in the log file? Lines above the block of ^@ are normal ssh authentication failures.

I notice it says (Power Button) on the first line after the ^@.

Does this mean someone at the data center pushed the power button on the machine hosting my VPS?

Answer 1

You have a block of null bytes in your log file. This could be due to:

• A bug in the syslog program. Unlikely.
• A kernel bug, especially one in the filesystem or disk drivers. Mildly likely.
• A failing disk. Since you have a VPS, that's something to ask the VPS provider.
• Failing RAM. Since you have a VPS, that's something to ask the VPS provider. On a machine running on non-ECC hardware, RAM is the first thing I'd check.
• An attacker clumsily failing to hide their tracks. Very unlikely because writing zeros is a strange way to hide — copying harmless log messages or plain deleting the incriminating ones would be the normal thing.

The message about the power button provides no information about the cause of the reboot. It's saying that now, in the current session, systemd will initiate a system shutdown if you press the shutdown button.