An unexpected server reboot can be difficult to investigate, especially when the system is already back online. By the time an administrator starts checking the issue, important logs or information about what happened before the reboot may no longer be easy to correlate.
Oracle Linux Enhanced Diagnostics provides the oled lastboot tool to help with this situation.
What is oled lastboot?
lastboot is part of the oled-tools package. It installs a small systemd service that runs once during every boot.
Its purpose is simple:
Check what happened during the previous boot.
Determine whether the reboot was graceful or unexpected.
Check whether the unexpected reboot appears to be related to a kernel crash.
Generate a report that can be reviewed after the server comes back online.
For abnormal reboots, optionally collect additional information using hooks.
This is particularly useful when a server unexpectedly restarts and you need to start the investigation after the system has recovered.
Enable lastboot
After installing the required oled-tools package, enable the service:
# oled lastboot enable
Check its status:
# oled lastboot status
The service runs during boot and then exits. It is not a continuously running background process.
The generated reports are stored under:
/var/oled/lastboot-report/
You can also check the service activity using:
# journalctl -u oled_lastboot_report.service -b
How does it identify the previous reboot?
lastboot checks recent reboot and shutdown records from wtmp.
If a shutdown record exists before the reboot, the previous reboot is classified as:
Graceful reboot
If a reboot record exists without a matching shutdown record, it is classified as:
Unexpected reboot
This distinction is important because an unexpected reboot could have several causes, including power loss, host reset, kernel panic, or another failure path.
How does it detect a possible kernel crash?
For an unexpected reboot, lastboot looks for a vmcore file in the configured kdump location.
It reads the path setting from:
/etc/kdump.conf
It also checks:
/var/crash
/var/oled/crash
If a recent vmcore is found within the defined crash-detection window, the event is reported as:
Kernel crash
The report also provides recommended follow-up actions, such as collecting the vmcore, an sosreport, PCP data and console or serial logs when available.
The most useful command for an administrator
Once the server is back online, start with:
# oled lastboot report
The report provides information such as:
Host name
Boot time
Time zone
Reboot status
Kernel crash status
Detected
vmcorepathRecommended follow-up actions
The status gives you a quick indication of what happened:
Graceful reboot – A matching shutdown record was found.
Unexpected reboot – The previous boot did not have a matching graceful shutdown record.
Kernel crash – The reboot was unexpected and a recent vmcore was found.
Going beyond the basic report
For abnormal reboots, lastboot can also run administrator-defined hooks.
Hooks are executable scripts placed under:
/usr/libexec/oled-tools/lastboot-hooks.d/
These can collect environment-specific information such as logs, command output, sosreport, vmcore metadata or application-specific files.
The collected artifacts are stored under:
/var/oled/lastboot-artifacts/
The corresponding state information is stored under:
/var/lib/oled/lastboot/state/
The state file also records whether a hook completed successfully, failed, timed out or was skipped.
Why this is useful during an incident
For a junior or mid-level administrator, one of the challenges after an unexpected reboot is knowing where to start.
Instead of immediately going through multiple logs, oled lastboot provides a starting point:
# oled lastboot report
If the reboot was unexpected, you can then check:
# journalctl -u oled_lastboot_report.service -b
and review the generated report and any collected artifacts.
This helps preserve and organize information close to the time of the reboot, making the initial investigation more structured.
Key takeaway
oled lastboot is a useful Oracle Linux diagnostic tool to have enabled on systems where unexpected reboots need to be investigated.
The workflow is straightforward:
Enable → Reboot occurs → Server comes back → Review oled lastboot report → Investigate further if the reboot was abnormal.
For abnormal reboots, the tool can go further by running hooks, collecting environment-specific information and, when configured, uploading the collected artifacts.
For administrators responsible for Oracle Linux servers, knowing about lastboot can make the first few steps after an unexpected reboot much easier and more consistent.