Date: Mon, 12 Nov 2001 22:02:18 -0500 From: Derrick Norris <denorris@bellsouth.net> To: freebsd-questions@freebsd.org Subject: Where can I look for causes of a random reboot? Message-ID: <200111130302.fAD32Ib12571@visar.norris-net.com>
next in thread | raw e-mail | index | archive | help
Today my machine spontaneously rebooted while I was at work. I am pretty anal and log everything I can think of; my /var/log/all.log shows my machine checking mail at 14:50, then boot messages start appearing at 14:56, with nothing in between. Output of "last" just shows a reboot at 14:56, not a "crash" or anything like that. I was remotely connected to the machine during the day, but I had logged off before the reboot happened. The machine is connected to a UPS and nut is running, but there were no messages about anything funky with the UPS and my wife said the power didn't go off today anyway. As far as remote access, I have only sshd running on 4.4-RELEASE which should be protected against the recent sshd exploit. There are also ports open for nut, syslog, thttpd, healthd, smtp, and identd. I believe I configured most of those services (those that could be) to listen only for local connections, but some are listening to the world. I can find no evidence of an attack but an attacker may have covered their tracks. Are there any other places I can look to see what might have caused this reboot? Thanks, Derrick To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200111130302.fAD32Ib12571>