I currently have a system which reboots every 1 in 3 reboots, I can find the date time as to when and i can find out who (just says system) but I cannot find out why.

I was wondering if it was at all possible to replace the reboot script (and how would i do this?) with a dud so it would capture who, where and why is trying to activate the reboot?

I am using linux linaro - which is a ubuntu based FS - open to any suggestions on debugging this issue

  • 2
    which reboots every 1 in 3 reboots <--- really ? :-) Feb 25, 2016 at 16:51
  • 1
    @ColinPitrat maybe i explained it badly lol yes every time I power up the linux device it powers up fine.. except for the 3rd time...in which it will reboot upon starting
    – TheHidden
    Feb 25, 2016 at 16:52
  • Ah OK, you're sentence does make sense indeed :-) When does it reboot ? During the boot or after ? If during, at which step ? Feb 26, 2016 at 6:37
  • @ColinPitrat it happens after everything is booted :< about 30 seconds or less after a complete boot.
    – TheHidden
    Feb 26, 2016 at 9:19

1 Answer 1


Dirty scripts way

There are multiple ways to reboot. One way I see to investigate is to replace shutdown, halt, reboot and init by scripts:

for cmd in shutdown halt reboot init
    mv /usr/bin/$cmd /usr/bin/${cmd}.ori
    ln -s /usr/bin/${cmd}.ori /usr/bin/$cmd

Then create a shell script logging the information:

echo "$0 called with $@ by $USER at `time` - Processes: `ps axjf`" >> /var/log/reboot.log
${0}.ori $@

And copy or link it as /usr/bin/{shutdown,halt,reboot,init}. You also want to create the /var/log/reboot.log and ensure anybody will be able to log in it, although only root should be able to reboot.

The ps axjf should allow you to see which process called your script. You may want to add more information in the log but this should be a good start.

Things that may be missed

Other commands could reboot the system by calling the syscall reboot. It could be "official" commands or "rogue" ones.

X server is able to shutdown and with some settings, any user can do it. If remote access and shutdown are allowed, other people can require a shutdown at distance (however this wouldn't explain the every other 3 reboot behaviour).

Init target

You could:

  • add a step at the beginning of the target in runlevels 0 and 6 that wait for some time (e.g: sleep 60 or a bit more)
  • have a script running ps axjf every 60 seconds and logging in a file

This should provide info on running processes at the time of the shutdown. Of course, you can add other commands that could help you to investigate to the stuff executed every 60 seconds

Kernel auditing

Another way to investigate this would be to use the kernel auditing feature, but it needs to be enabled in your kernel (not the case in many distribs).

Then use:

auditctl -a entry,always -S reboot

to record every call to reboot, and use ausearch to find the calls that were done.

  • I cannot seem to find anything in /usr/bin... but I find encoded scripts within /sbin/ do i do the same thing but here instead?
    – TheHidden
    Feb 26, 2016 at 11:23
  • Depending on the distribution, the location of the command may be different. You can do it for /sbin commands instead of /usr/bin. I should have precised to use which reboot to find where the command really was Feb 26, 2016 at 11:34
  • I have gotten alot of data. but I do not know how to read it :< im not l33t h4xx0r yet.
    – TheHidden
    Feb 26, 2016 at 14:42
  • Did you manage to find the occurence corresponding to the undesired reboot in it ? Do you have the output of ps axjf in it ? If yes, do you manage to find the part of the tree corresponding to the reboot command ? Feb 27, 2016 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .