2

I have a raspberry pi 4 that runs a samba server (+ 2TB HDD) and it suddenly rebooted. I use a pretty big heatsink to keep the pi cool and I use the official raspberry pi power supply.

Florin Baciu
  • 21
  • 2
  • I have has this happen now and again (maybe once in three weeks). RPI4 with Raspbian Buster controlling a amateur radio transceiver. I attributed it to maybe RF getting in but it has shutdown usually when just receiving. – G8HAV Jan 25 '21 at 15:47
  • The chances of the system actually rebooting due to RF or cosmic rays etc. is I think infinitesimal: These things could cause some kind of malfunction, but rebooting is a very specific event. It isn't something that "just happens" because something has gone wrong. If the malfunction crashed the system, it would simply stop. Rebooting is something that is either on purpose or caused by the power cycling. – goldilocks Jan 25 '21 at 15:53
  • Unfortunately, the "the official raspberry pi power supply" is no guarantee against low power problems. I have a 4 GB Pi 4 with a small USB 3.0 drive attached and the official 3A supply and while I have never noticed it shutdown, low voltage warnings occur in the logs regularly. – goldilocks Jan 25 '21 at 15:56

2 Answers2

3

last reboot provides you a log of reboot events which were requested by software: either a command from a privileged user (e.g. sudo reboot) or a script. Note: the reboot event corresponds to the end time, not the start time:

pi@raspberrypi: $ last reboot
reboot   system boot  5.4.79-v7l+      Thu Jan  1 01:00   still running
reboot   system boot  5.4.79-v7l+      Thu Jan  1 01:00 - 14:55 (18651+13:55)

pi@raspberrypi: $ date -d "19700101 UTC +18651 days 13:55"
Sun 24 Jan 2021 02:55:00 PM CET

Everything else is a hardware event which you can only definitely track down by monitoring voltage, temperature and reset pins externally.

Dmitry Grigoryev
  • 27,918
  • 6
  • 53
  • 144
  • last reboot seems to have "issues"... on my system, the date & time are the same for all entries. – Seamus Jan 25 '21 at 19:55
  • 1
    running last -x, ignoring any user login/out entries shows a little more useful info ... controlled shutdowns/restarts result in the sequence runlevel, reboot, shutdown (in the order shown by the output of that command) - any time there's a power failure, you'll see runlevel, reboot, runlevel (from the previous boot) - in that case you can pretty much tell if there was a power interruption – Jaromanda X Jan 26 '21 at 06:28
  • 1
    @Seamus last reboot always shows 1 Jan because it happens before the time is set. last -x lets you see these in context. – Milliways Jan 26 '21 at 06:38
  • 1
    @Seamus last reboot shows start time and end time for each system run. The start time is 19700101 UTC every time, because the system starts without a proper clock. However, the reboot itself corresponds to the end time, which should be accurate if the Pi is connected to the network and gets the time from NTP. BTW, last -x shows exactly the same entries, only you get login/runlevel/shutdown events in addition. – Dmitry Grigoryev Jan 26 '21 at 08:37
  • 1
    Thanks... I had not used this command until your answer. When I saw your answer, 1st reaction: "Nice! +1" Then after fiddling around a bit, "Ugh - this is useless". I think I get it now, but still not clear on all I've read... The implementation & man page are NRFPT IMHO. Esp the need to "decode" the times... I get the need for the Unix epoch, but even running this on a system w/ RTC is not much better. User must also understand how wtmp log is formatted, last seems not to add very much at all. I'd consider last --time-format iso reboot a better choice for clarity. Good answer though! – Seamus Jan 26 '21 at 09:10
2

That it rebooted implies one of two things:

  1. The system was intentionally rebooted for some reason. If this is the case, the event would be logged; have a look back through /var/log/syslog to when this happened. If instead you find the log stops and restarts abruptly, possibly with a short burst of garbage bytes in between, then there was no reboot and only the second option is possible.

  2. The power was cycled. This could have been a momentary external interruption, or it could be because the SoC shut down due to insufficient power.

These are the only two things which can trigger a reboot -- it's either intentional or caused by the power cycling. If the OS just crashes for some reason, the system would simply shutdown and not spontaneously reboot.

goldilocks
  • 58,849
  • 17
  • 112
  • 227
  • Or the watchdog – Milliways Jan 25 '21 at 20:56
  • Yes, although since you have to enable that intentionally I'd hope you'd have considered that. Since it has a software component to cleanly stop the OS, it would likely fall under #1 above, except in cases where the fs is no longer writable or something. – goldilocks Jan 25 '21 at 21:06