Date: Mon, 18 Aug 2008 09:53:44 -0700 From: Jeff Kletsky <jeff+freebsd@wagsky.com> To: freebsd-questions@freebsd.org Subject: Re: FreeBSD-7 reboots hourly Message-ID: <48A9A918.4030607@wagsky.com>
next in thread | raw e-mail | index | archive | help
I had a similar puzzle to unravel with a CentOS (RHEL equivalent) box.
The clues there were in the log files that showed that gdm was exec-ing
shutdown. I'm not suggesting that is the answer here, but looking at
your logs may help.
While the CentOS shutdown process is different than FreeBSD, you might
get some use out of "wrapping" the commands that shutdown the box to see
who called them. The script below worked for CentOS and probably needs
some modification for FreeBSD, but the idea is to log the caller (and
caller's caller) of all the executables that are used to
shutdown/halt/reboot etc. the system.
(Note that this one errors in ps if there isn't a ppid at one of the
levels, but it doesn't seem to hurt anything and could be cleaned up
with a check of the ppid variables used).
This is a ***CentOS*** script -- use for concept with FreeBSD
$ cat /sbin/shutdown
#!/bin/bash
### Log who is calling a program
###
### Program to be executed
###
true_executable="/sbin/shutdown.orig"
#
# Helper commands
#
ps="/bin/ps --noheaders"
logger="/usr/bin/logger -t $0[$$]"
#
this_ps_line=`${ps} up $$`;
# Get parent
this_ppid=`${ps} -p $$ -o ppid=`;
ppid_ps_line=`${ps} up ${this_ppid}`
# And parent's parent
ppid_ppid=`${ps} -p ${this_ppid} -o ppid=`;
ppid_ppid_ps_line=`${ps} up ${ppid_ppid}`;
${logger} "Called by: ${ppid_ps_line}"
${logger} "w/ parent: ${ppid_ppid_ps_line}"
${logger} "Remaining parameters: $@"
exec ${true_executable} $@
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48A9A918.4030607>