How to figure out who shutdown box

[Kelly D. Grills]

On Sat, Mar 04, 2006 at 10:24:17AM -0500, Jon Poland wrote:
> 
> Hi,
>   I operate a colo box running FreeBSD 6.0-SECURITY.  Yesterday the box
> shutdown and powered off.  I didn't execute shutdown or halt, and I'm the
> only user who can.  Here's what the logs tell me:
> 
> /var/log/console.log:
> Mar  3 11:24:29 kmart kernel: Shutting down daemon processes:
> 
> /var/log/messages:
> Mar  3 11:24:38 kmart syslogd: exiting on signal 15
> 
> last: (the important lines)
> reboot           ~                         Fri Mar  3 13:10
> shutdown         ~                         Fri Mar  3 11:24
> 
> I don't see anything in any of the logs like "rebooted by X", etc.
> 
> I'm not exactly sure how this can happen and looking for ideas.
> 

Where are you logging security messages? I believe the default is to
/var/log/security

Have a look at /etc/syslog.conf and syslog.conf(5)

You should see messages such as this in your security log:
Mar  1 15:21:38 srv1 shutdown: reboot by kdgrills:

-- 
Kelly D. Grills
kdgrills at the-grills.com



-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 243 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20060304/81f36f7b/attachment.bin