shutdown forensics

[Robert Huff]

Robin Becker writes:
>  I'm trying to figure out what caused an unplanned shutdown of a
>  freebsd 6.0 server; I see this in the last output
>  
>  reboot           ~                         Thu Apr 24 06:15
>  shutdown         ~                         Thu Apr 24 06:10
>  
>  but cannot see anybody having been logged in at the time. Is
>  there any way I can trace the origin of the shutdown command?

	I see a time like that, my gut suspicion for the shutdown is
"something drive y a cro job".


			Robert Huff


































































































































































































































































>  
>  I looked in the root shell history various other logs, but couldn't see 
>  anything obvious.