sys-forensics

name	sys-forensics
description	System freeze/crash investigation. Auto-run when: session-context detects boot age <1 hour (possible recent crash), operator reports a freeze or crash, system shows instability signs, or user runs /sys-forensics. Accepts optional --since argument. Invoke proactively without asking.

Investigate system freezes, crashes, and instability.

last -x reboot shutdown 2>/dev/null | head -5

journalctl -k -b -1 --no-pager -n 40 2>/dev/null || echo "No previous boot journal available"

journalctl -b -1 --grep="Xid" --no-pager -n 20 2>/dev/null || echo "No NVIDIA Xid errors in previous boot"

dmesg --level=err,crit,alert,emerg --time-format reltime 2>/dev/null | tail -30

journalctl -b 0 --priority=0..3 --no-pager -n 30 2>/dev/null

ls -la /var/lib/systemd/coredump/ 2>/dev/null | tail -5

journalctl -b -1 --grep="oom_reaper\|Out of memory\|invoked oom" --no-pager 2>/dev/null | tail -10

Correlate timestamps across sources. Common causes on this system:

• NVIDIA Xid errors (GPU crash) — most common. Check driver version, suggest downgrade if needed.
• OOM kills — check which process was killed, suggest memory limits.
• Kernel panic — check dmesg for panic trace.
• SP5100 TCO watchdog timeout — hardware watchdog triggered after 30s unresponsive.

Report: probable cause, affected services, and recommended mitigations.