On Wed, Jan 30, 2013 at 4:33 PM, Mike Miller <mbmiller+l at gmail.com> wrote: > On Wed, 30 Jan 2013, Michael Moore wrote: > >> On Wed, Jan 30, 2013 at 12:06 PM, Shawn Fertch <sfertch at gmail.com> wrote: >> >>> Have you setup kernel dumps to see if something can be captured? >> >> >> I have not. I'll set that up tonight when I get home from work. > > > Have you looked at what is in /var/log/messages or /var/log/dmesg? I'm not > sure those are the right log files to check, but someone else will know > which are best to look at. If linux crashed hard, it may not have had the ability to write to disk. sometimes it is preceeded by oopses or non-fatal panics, but in my experience not often enough. If that machine has a serial port i would recommend setting up a serial console, (for example: http://www.debuntu.org/how-to-set-up-a-serial-console-on-debian/) this will allow you to capture kernel messages that would otherwise be masked by X or bootsplash. All you need is another machine with a serial port to record what is happening. If you can reproduce the problem at will then you can keep an eye on it as it happens. There is an alternative to the serial console, the netconsole module. Unfortunately i have had only marginal success with this one, but it is worth a try. the syntax is something like: modprobe netconsole netconsole=@/eth0,515 at syslogserver/ but you can just setup a netcat listener on any port on another machine if you do not have a syslog server( nc -l 1515 )