Server freeze - how to debug

Solution 1:

Reconfigure your syslog to go to a different server -- this pushes events, any monitoring polls the server (probably miss the big segfault unless you poll at the exact instant it happens).

Grabbing logs to the machine that's crashing is a bad idea -- you will always lose the most import (read last) lines of the logs.

man rsyslog.conf gives info on redirecting to another machine, and how to configure to listen for logging messages.

The logs will show up in the syslog of the host prefaced with the name of the server they came from.

On the listening side 'man rsyslogd' will give you startup options which can then be set in /etc/default/rsyslog (you may need -4 or -6). You can verify it's listening with lsof -p pid_of_rsyslogd

Solution 2:

If you don't see anything in your /var/log/syslog or /var/log/messages files, I recomend you to use any system status record tool. I use nmon (in capture data mode) to monitoring my systems.

You can find it here

Solution 3:

The thing to do here is to look in your logs. They're usually found in /var/log. Make a note of the time you restart your system and look in the logs for messages immediately before that time.

/var/log/syslog
/var/log/messages
/var/log/apache2/error.log
/var/log/mysql*

would be good places to start.