About twice a week, sometimes more, the SLES11 SP2 server will be at the console screens and not the login screen. We use KDE on this server. Looking through the messages log, i see:

Nov 17 23:57:59 web kdm: web.server.com:1[24509]: Received unknown or unexpected command -2 from greeter
Nov 17 23:57:59 web kdm: web.server.com:1[24509]: Abnormal termination of greeter for display web.electrichendrix.com:1, code 1, signal 0
Nov 18 00:17:58 web syslog-ng[1313]: Log statistics; dropped='pipe(/dev/xconsole)=0', dropped='pipe(/dev/tty10)=0', processed='center(queued)=10709', processed='center(received)=10356', processed='destination(messages)=10174', processed='destination(mailinfo)=162', processed='destination(mailwarn)=13', processed='destination(localmessages)=6', processed='destination(newserr)=0', processed='destination(mailerr)=0', processed='destination(netmgm)=0', processed='destination(warn)=70', processed='destination(console)=51', processed='destination(null)=3', processed='destination(mail)=175', processed='destination(xconsole)=51', processed='destination(firewall)=0', processed='destination(acpid)=4', processed='destination(newscrit)=0', processed='destination(newsnotice)=0', processed='source(src)=10356'

Nov 18 01:23:07 web kdm_config[24793]: Multiple occurrences of key 'UseTheme' in section [X-*-Greeter] of /usr/share/kde4/config/kdm/kdmrc
Nov 18 01:23:07 web kdm: web.server.com:1[24809]: Fatal X server IO error: No such file or directory
Nov 18 01:43:07 web -- MARK --
Nov 18 02:03:08 web -- MARK --
Nov 18 02:17:59 web syslog-ng[1313]: Log statistics; dropped='pipe(/dev/xconsole)=0', dropped='pipe(/dev/tty10)=0', processed='center(queued)=10724', processed='center(received)=10365', processed='destination(messages)=10183', processed='destination(mailinfo)=162', processed='destination(mailwarn)=13', processed='destination(localmessages)=6', processed='destination(newserr)=0', processed='destination(mailerr)=0', processed='destination(netmgm)=0', processed='destination(warn)=72', processed='destination(console)=53', processed='destination(null)=3', processed='destination(mail)=175', processed='destination(xconsole)=53', processed='destination(firewall)=0', processed='destination(acpid)=4', processed='destination(newscrit)=0', processed='destination(newsnotice)=0', processed='source(src)=10365'
Nov 18 02:37:59 web -- MARK --
Nov 18 02:57:59 web -- MARK --
Nov 18 03:17:59 web -- MARK --
Nov 18 03:17:59 web syslog-ng[1313]: Log statistics; dropped='pipe(/dev/xconsole)=0', dropped='pipe(/dev/tty10)=0', processed='center(queued)=10728', processed='center(received)=10369', processed='destination(messages)=10187', processed='destination(mailinfo)=162', processed='destination(mailwarn)=13', processed='destination(localmessages)=6', processed='destination(newserr)=0', processed='destination(mailerr)=0', processed='destination(netmgm)=0', processed='destination(warn)=72', processed='destination(console)=53', processed='destination(null)=3', processed='destination(mail)=175', processed='destination(xconsole)=53', processed='destination(firewall)=0', processed='destination(acpid)=4', processed='destination(newscrit)=0', processed='destination(newsnotice)=0', processed='source(src)=10369'
Nov 18 03:26:15 web kdm_config[25063]: Multiple occurrences of key 'UseTheme' in section [X-*-Greeter] of /usr/share/kde4/config/kdm/kdmrc
Nov 18 03:26:15 web kdm_config[25069]: Multiple occurrences of key 'UseTheme' in section [X-*-Greeter] of /usr/share/kde4/config/kdm/kdmrc
Nov 18 03:26:15 web syslog-ng[1313]: Termination requested via signal, terminating;

No logs again until i reboot the server. Any idea how i can find out what is going on as when at the console, certain stuff fails like backups and remote access to name 2.