I've been dealing with my hardened install, which I use as an Unbound/DNSCrypt server for the home office network, crashing every few days with no discernible core dump - even after it's already been set up and should be logging to /var/crash - or log entries. Journald always stops logging a few minutes before crash. This ALWAYS happens when I'm out of the room so I can't see anything happening on screen either. And the craziest part??

If I try to induce a crash dump through the SysRq keys, and possibly in the process figure out what in God's name is keeping this system from writing to /var/crash, the hard drive will automatically go to sleep once I press S or U. Call me crazy, but I thought the correct operations for that were "sync" and "unmount" rather than "sleep."

Sometimes I'll end up being booted to recovery mode with errors on the partition used for /var/log. I really want to know what's causing this now, because I'm all out of answers on my end.

Could it possible be a hardware issue like a corroded capacitor? A common issue on older boards that is only detected by physical examination of the capacitors for leaks or bulging.

I would hope it's not that, being one of those bubble-sealed laptops that it's next to impossible to get open I'm SOL should that turn out to be the cause.

But on the slightly better side of things, I managed to see it happen this time. Had a couple of things happening, one of them being an AUR compilation job to update my selinux packages. My USB drive was in, kernel.deny_new_usb was set to 0, and the light on the USB was blinking every second. I thought the system couldn't sense my USB drive, but had other things to fix at the time. Right before the crash, as both of these things were still going on, the caps lock light ALSO started blinking fast.

That was it. Boom, down like a drunk sorority girl in New Orleans.

Booted into a Kali Live USB I keep around for work purposes to (hopefully) repair partitions and fix things. Still no core dump.

May I suggest a way forward?

When it crashes out, power off, and reboot with anything but your hardened system. Presuming you boot a live system, mount the hardened slackware root and examine /var/log/dmesg on the hardened system. If the hardened system is mounted on /mnt, you want /mnt/var/log/dmesg - the end of it, which might show interesting stuff. Post anything interesting.