[sylwester]

twice now i have come in to see the login screen on our xserve, it's as if the server is restarting on its own. Many of the logs only date back to the time of he startup. They don't appear to be in conjunction with a retrospect backup either. What else should i be checking to find the issue?

[Rainy Day]

Hmmm. I'd take this seriously. If you've a gremlin in your box (i.e. if you've been hacked), unexplained restarts and wiped log files are not uncommon. Now would be a good time to verify the md5 checksums on your box.

Of course the cause could be something benign too.

If you haven't recorded the md5 checksums from the files on your box, you should read up on it (and intruder detection in general).

[sylwester]

I'm not sure it it's 100% related, but a pci fan started to go bad around the same time as the restarts, I have since replaced the fan and have not encountered a problem since. But I will look into recording md5 checksums as an additional security precaution, seems to make sense.

[phreakanature]

Do you have the server setup to auto restart after a crash? That could be the simple solution to at least why you are presented with the login menu

[Jellytussle]

Why are you leaving the server logged in in the first place? Then anyone who can access the box can reboot it.

What time does the reboot occur? The system.log will roll at 03.15.

Good luck with MD5 hashes, OS X's habit of prebinding after updates usually puts paid to that.

[Rainy Day]

Why are you leaving the server logged in in the first place? Then anyone who can access the box can reboot it.

Anyone with physical access to the box can reboot it whether or not it's logged in (even if the Hide the Restart and Shut Down buttons checkbox is selected). Granted, leaving it logged in makes it easier to co-opt, but that's secondary to controlling access to the box itself.

Good luck with MD5 hashes, OS X's habit of prebinding after updates usually puts paid to that.

I'm unfamiliar with the idiom "puts paid to that," but i assume you're saying it'll wreak havoc with md5 checksuming. Prebinding only affects native MacOS X applications, and so is not going to affect very many files. I'm not sure if prebinding creates a cache file for each App, or a single cache file for each library. Either way, the number of files affected is small. One's md5 script could simply ignore the prebinding cache files, as you're likely to do with other files which change frequently (e.g. log files). MacOS X prebinding really isn't an impediment to tracking md5 checksums.

[Link]

If anything it could simply be loginwindow dying. This happens every now and then on my g4..