How to figure out who shutdown box (Kelly D. Grills)
polandj at monkey.org
Mon Mar 6 03:22:10 UTC 2006
For me, those show up in /var/log/messages:
Jan 17 22:54:23 kmart reboot: rebooted by polandj
But nothing for the particular shutdown in question...
On Sat, Mar 04, 2006 at 10:24:17AM -0500, Jon Poland wrote:
>> I operate a colo box running FreeBSD 6.0-SECURITY. Yesterday the box
>> shutdown and powered off. I didn't execute shutdown or halt, and I'm
>> only user who can. Here's what the logs tell me:
>> Mar 3 11:24:29 kmart kernel: Shutting down daemon processes:
>> Mar 3 11:24:38 kmart syslogd: exiting on signal 15
>> last: (the important lines)
>> reboot ~ Fri Mar 3 13:10
>> shutdown ~ Fri Mar 3 11:24
>> I don't see anything in any of the logs like "rebooted by X", etc.
>> I'm not exactly sure how this can happen and looking for ideas.
> Where are you logging security messages? I believe the default is to
> Have a look at /etc/syslog.conf and syslog.conf(5)
> You should see messages such as this in your security log:
> Mar 1 15:21:38 srv1 shutdown: reboot by kdgrills:
More information about the freebsd-questions