Date: Tue, 7 Mar 2006 11:29:01 +0000 From: Ceri Davies <ceri@submonkey.net> To: Jon Poland <polandj@monkey.org> Cc: freebsd-questions@freebsd.org Subject: Re: How to figure out who shutdown box (Kelly D. Grills) Message-ID: <20060307112900.GJ85550@submonkey.net> In-Reply-To: <Pine.BSO.4.58.0603052217001.25082@naughty.monkey.org> References: <Pine.BSO.4.58.0603052217001.25082@naughty.monkey.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--6cMF9JLEeZkfJjkP
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun, Mar 05, 2006 at 10:22:08PM -0500, Jon Poland wrote:
> On Sat, Mar 04, 2006 at 10:24:17AM -0500, Jon Poland wrote:
> >>
> >> Hi,
> >> I operate a colo box running FreeBSD 6.0-SECURITY. Yesterday the box
> >> shutdown and powered off. I didn't execute shutdown or halt, and I'm
> >the
> >> only user who can. Here's what the logs tell me:
> >>
> >> /var/log/console.log:
> >> Mar 3 11:24:29 kmart kernel: Shutting down daemon processes:
> >>
> >> /var/log/messages:
> >> Mar 3 11:24:38 kmart syslogd: exiting on signal 15
> >>
> >> last: (the important lines)
> >> reboot ~ Fri Mar 3 13:10
> >> shutdown ~ Fri Mar 3 11:24
> >>
> >> I don't see anything in any of the logs like "rebooted by X", etc.
> >>
> >> I'm not exactly sure how this can happen and looking for ideas.
> >>
> >
> > Where are you logging security messages? I believe the default is to
> > /var/log/security
> >
> > Have a look at /etc/syslog.conf and syslog.conf(5)
> >
> > You should see messages such as this in your security log:
> > Mar 1 15:21:38 srv1 shutdown: reboot by kdgrills:
>=20
> For me, those show up in /var/log/messages:
> Jan 17 22:54:23 kmart reboot: rebooted by polandj
>=20
> But nothing for the particular shutdown in question...
It's possible that someone hit the power button.
Ceri
--=20
That must be wonderful! I don't understand it at all.
-- Moliere
--6cMF9JLEeZkfJjkP
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.1 (FreeBSD)
iD8DBQFEDW58ocfcwTS3JF8RArCEAJ9P1HrLQ1XxBQPsJ3Fvvr5Wek36oQCfQNGV
qRhuCOb8CVgEfvjALRgb2z0=
=Hp63
-----END PGP SIGNATURE-----
--6cMF9JLEeZkfJjkP--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060307112900.GJ85550>