Silent Reboot Investigation

Determine why a server rebooted at 3 AM with no alert and no maintenance window.

A advanced Linux challenge worth 20 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

The server rebooted at 03:47 AM. No schedule, no alert. Each reboot cause has a different forensic fingerprint in the logs.

Your tasks:

• Review the pre-generated incident logs at /var/log/incident/
• Look for OOM evidence: grep -i "oom\|killed\|out of memory" /var/log/incident/kern.log
• Look for panic: grep -i "kernel panic" /var/log/incident/kern.log
• Look for clean shutdown: grep -i "systemd-shutdown\|reboot" /var/log/incident/syslog
• State cause with evidence in /tmp/reboot_cause.txt

Format: CAUSE: <type> EVIDENCE: <log line>

• Run check to validate