Why does Red Hat Enterprise Linux Server reboot with "signal 15" messages in /var/log/messages?

Solution Verified - Updated

Environment

  • Red Hat Enterprise Linux (RHEL) 4, 5, 6, 7, 8

Issue

  • Server rebooted with "signal 15."

  • Server automatically rebooted.

  • Server unexpectedly rebooted.

  • What does exiting on signal 15 mean in /var/log/messages?

    shutdown: shutting down for system reboot
init: Switching to runlevel: 6
[...]
exiting on signal 15
syslogd 1.4.1: restart.
syslog: syslogd startup succeeded

  • Server rebooted unexpectedly with the shutdown message in /var/log/messages.

    <hostname> shutdown[7180]: shutting down for system reboot <--- This log shows manual REBOOT triggered by someone
<hostname> snmpd[4058]: cmaX: subMIB 18 handler has disconnected 
<hostname> sshd[7113]: Transferred: sent 5192, received 3424 bytes
<hostname> snmpd[4058]: cmaX: subMIB 1 handler has disconnected 
<hostname> .
<hostname> .
<hostname> .
<hostname> snmpd[4058]: cmaX: subMIB 21 handler has disconnected 
<hostname> snmpd[4058]: cmaX: subMIB 22 handler has disconnected 
<hostname> snmpd[4058]: cmaX: subMIB 23 handler has disconnected 
<hostname> hpasmxld[4551]: Process has been instructed to stop from the user interface. Stopping hpasmxld process. . . 
<hostname> xinetd[4114]: Exiting...
<hostname> vasd[25173]: vasd IPC handler (PID 25173) exiting
<hostname> vasd[11150]: vasd parent process (PID 11150) exiting
<hostname> kernel: ACPI: PCI interrupt for device 0000:01:04.6 disabled
<hostname> ntpd[4129]: ntpd exiting on signal 15
<hostname> vasproxyd[11280]: 11280: Got SIGTERM/SIGINT. Shutting down...
<hostname> rpc.statd[3730]: Caught signal 15, un-registering and exiting.
<hostname> portmap[9171]: connect from 127.0.0.1 to unset(status): request from unprivileged port
<hostname> kernel: Kernel logging (proc) stopped.
<hostname> kernel: Kernel log daemon terminating.
<hostname> exiting on signal 15
<hostname> syslogd 1.4.1: restart.

Resolution

  • The system was issued a command to shut down from either a user or software application
  • There is no way to know from the messages if the command was given by a user or by software

Root Cause

  • The exiting on signal 15 message is the last message the syslog service emits during a normal shutdown. The presence of this message in the messages file indicates a directed shutdown of the system. Either from a user or a program.
    In order to further investigate this type of condition, if it is occurring repeatedly, the following article can be used to determine which user may have triggered Reboot/Shutdown.
    How to find which user has rebooted the system?

Diagnostic Steps

  1. Is there any system health monitoring software running which may issue the shutdown command? Examples may include:
  • Automatic system recovery software
  • Hardware monitors
  • UPS software with shutdown capability etc.

  1. Verify whether any individual ran the shutdown command.

  2. If using sudo, check /var/log/secure for sudo shutdown commands:

    # egrep 'shutdown|reboot|init' /var/log/secure

  3. Check root (and any other admin users) .bash_history for any shutdown or init commands

  4. This will be less useful as there are no timestamps associated with the commands, but as the commands are in time order (latest at the bottom), it may be possible to determine which account is responsible.

    # egrep 'shutdown|reboot|init' /root/.bash_history
SBR
Product(s)
Components
Category
Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.