Trying to find the reason behind server shutdown

[bluecup]

Our Centos server shut down and the web host support had to start the server. However, they said they couldn't identify what had caused the server shutdown.

I tried this command to see when the server was last booted up:

[root@xxxxxxx log]# last -x reboot
reboot   system boot  3.10.0-1160.15.2 Fri May  4 18:03 - 20:35  (02:31)

So, 18:03 is when the support started the server. This looks right to me.

I checked /var/log/messages:

May  4 17:38:49 xxxxxxx p0f: [!] WARNING: Too many tracked connections, deleting 101. Use -m to adjust.
May  4 17:38:49 xxxxxxx p0f: [!] WARNING: Too many tracked connections, deleting 101. Use -m to adjust.
May  4 17:38:49 xxxxxxx kernel: ERROR anon_vma num_children for anon_vma ffff880002a93460 3 > 2
May  4 17:38:49 xxxxxxx p0f: [!] WARNING: Too many tracked connections, deleting 101. Use -m to adjust.
May  4 17:38:50 xxxxxxx p0f: [!] WARNING: Too many tracked connections, deleting 101. Use -m to adjust.
May  4 17:38:50 xxxxxxx p0f: [!] WARNING: Too many tracked connections, deleting 101. Use -m to adjust.
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
May  4 18:03:40 xxxxxxx journal: Runtime journal is using 8.0M (max allowed 199.6M, trying to leave 299.4M free of 1.9G available → currentlimit 199.6M).
May  4 18:03:40 xxxxxxx kernel: Initializing cgroup subsys cpuset
May  4 18:03:40 xxxxxxx kernel: Initializing cgroup subsys cpu
May  4 18:03:40 xxxxxxx kernel: Initializing cgroup subsys cpuacct

There were no entries recorded in the logs right after 17:38:50 and were indicated by ^@^@^@^@^@. Looks like the server had shut down at 17:38:50.

Is there a way to find out what had caused the server to shut down?
Does anything in /var/log/messages entries above indicate the reason behind the shutdown?

 

[mtindor]

It is probably this:

May 4 17:38:49 xxxxxxx kernel: ERROR anon_vma num_children for anon_vma ffff880002a93460 3 > 2

ERROR anon_vma num_children for anon_vma

CloudLinux's Status Page - ERROR anon_vma num_children for anon_vma.

cloudlinux.statuspage.io

CloudLinux sent this in an email:

ERROR anon_vma num_children for anon_vma

Incident status: Identified

If your server is affected, you can mitigate the problem by running the following command:
# kcarectl --unload; kcarectl --update

In case of any doubt, please contact the CloudLinux Support team.

I would recommend that you perform the kcarectl commands outlined by CloudLinux.