From owner-freebsd-questions@FreeBSD.ORG Wed Aug 20 17:25:08 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DEA201065673 for ; Wed, 20 Aug 2008 17:25:08 +0000 (UTC) (envelope-from jeff+freebsd@wagsky.com) Received: from mailgw.wagsky.com (wildside.wagsky.com [64.220.148.97]) by mx1.freebsd.org (Postfix) with ESMTP id C13B08FC12 for ; Wed, 20 Aug 2008 17:25:08 +0000 (UTC) (envelope-from jeff+freebsd@wagsky.com) Received: from port5.pn.wagsky.com (port5.pn.wagsky.com [192.168.6.5]) by mailgw.wagsky.com (Postfix) with ESMTP id 1311C5C89; Mon, 18 Aug 2008 09:53:44 -0700 (PDT) Message-ID: <48A9A918.4030607@wagsky.com> Date: Mon, 18 Aug 2008 09:53:44 -0700 From: Jeff Kletsky User-Agent: Thunderbird 2.0.0.16 (Macintosh/20080707) MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: FreeBSD-7 reboots hourly X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Aug 2008 17:25:09 -0000 I had a similar puzzle to unravel with a CentOS (RHEL equivalent) box. The clues there were in the log files that showed that gdm was exec-ing shutdown. I'm not suggesting that is the answer here, but looking at your logs may help. While the CentOS shutdown process is different than FreeBSD, you might get some use out of "wrapping" the commands that shutdown the box to see who called them. The script below worked for CentOS and probably needs some modification for FreeBSD, but the idea is to log the caller (and caller's caller) of all the executables that are used to shutdown/halt/reboot etc. the system. (Note that this one errors in ps if there isn't a ppid at one of the levels, but it doesn't seem to hurt anything and could be cleaned up with a check of the ppid variables used). This is a ***CentOS*** script -- use for concept with FreeBSD $ cat /sbin/shutdown #!/bin/bash ### Log who is calling a program ### ### Program to be executed ### true_executable="/sbin/shutdown.orig" # # Helper commands # ps="/bin/ps --noheaders" logger="/usr/bin/logger -t $0[$$]" # this_ps_line=`${ps} up $$`; # Get parent this_ppid=`${ps} -p $$ -o ppid=`; ppid_ps_line=`${ps} up ${this_ppid}` # And parent's parent ppid_ppid=`${ps} -p ${this_ppid} -o ppid=`; ppid_ppid_ps_line=`${ps} up ${ppid_ppid}`; ${logger} "Called by: ${ppid_ps_line}" ${logger} "w/ parent: ${ppid_ppid_ps_line}" ${logger} "Remaining parameters: $@" exec ${true_executable} $@