How to figure out who shutdown box (Kelly D. Grills)

[Ceri Davies]

On Sun, Mar 05, 2006 at 10:22:08PM -0500, Jon Poland wrote:
> On Sat, Mar 04, 2006 at 10:24:17AM -0500, Jon Poland wrote:
> >>
> >> Hi,
> >>   I operate a colo box running FreeBSD 6.0-SECURITY.  Yesterday the box
> >> shutdown and powered off.  I didn't execute shutdown or halt, and I'm
> >the
> >> only user who can.  Here's what the logs tell me:
> >>
> >> /var/log/console.log:
> >> Mar  3 11:24:29 kmart kernel: Shutting down daemon processes:
> >>
> >> /var/log/messages:
> >> Mar  3 11:24:38 kmart syslogd: exiting on signal 15
> >>
> >> last: (the important lines)
> >> reboot           ~                         Fri Mar  3 13:10
> >> shutdown         ~                         Fri Mar  3 11:24
> >>
> >> I don't see anything in any of the logs like "rebooted by X", etc.
> >>
> >> I'm not exactly sure how this can happen and looking for ideas.
> >>
> >
> > Where are you logging security messages? I believe the default is to
> > /var/log/security
> >
> > Have a look at /etc/syslog.conf and syslog.conf(5)
> >
> > You should see messages such as this in your security log:
> > Mar  1 15:21:38 srv1 shutdown: reboot by kdgrills:
> 
> For me, those show up in /var/log/messages:
> Jan 17 22:54:23 kmart reboot: rebooted by polandj
> 
> But nothing for the particular shutdown in question...

It's possible that someone hit the power button.

Ceri
-- 
That must be wonderful!  I don't understand it at all.
                                                  -- Moliere
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20060307/a3476d4a/attachment.bin