Date: Sun, 5 Mar 2006 22:22:08 -0500 (EST) From: Jon Poland <polandj@monkey.org> To: freebsd-questions@freebsd.org Subject: Re: How to figure out who shutdown box (Kelly D. Grills) Message-ID: <Pine.BSO.4.58.0603052217001.25082@naughty.monkey.org>
next in thread | raw e-mail | index | archive | help
For me, those show up in /var/log/messages: Jan 17 22:54:23 kmart reboot: rebooted by polandj But nothing for the particular shutdown in question... - JP On Sat, Mar 04, 2006 at 10:24:17AM -0500, Jon Poland wrote: >> >> Hi, >> I operate a colo box running FreeBSD 6.0-SECURITY. Yesterday the box >> shutdown and powered off. I didn't execute shutdown or halt, and I'm >the >> only user who can. Here's what the logs tell me: >> >> /var/log/console.log: >> Mar 3 11:24:29 kmart kernel: Shutting down daemon processes: >> >> /var/log/messages: >> Mar 3 11:24:38 kmart syslogd: exiting on signal 15 >> >> last: (the important lines) >> reboot ~ Fri Mar 3 13:10 >> shutdown ~ Fri Mar 3 11:24 >> >> I don't see anything in any of the logs like "rebooted by X", etc. >> >> I'm not exactly sure how this can happen and looking for ideas. >> > > Where are you logging security messages? I believe the default is to > /var/log/security > > Have a look at /etc/syslog.conf and syslog.conf(5) > > You should see messages such as this in your security log: > Mar 1 15:21:38 srv1 shutdown: reboot by kdgrills:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSO.4.58.0603052217001.25082>