shutdown forensics

[Robin Becker]

Robert Huff wrote:
> Robin Becker writes:
>>  I'm trying to figure out what caused an unplanned shutdown of a
>>  freebsd 6.0 server; I see this in the last output
>>  
>>  reboot           ~                         Thu Apr 24 06:15
>>  shutdown         ~                         Thu Apr 24 06:10
>>  
>>  but cannot see anybody having been logged in at the time. Is
>>  there any way I can trace the origin of the shutdown command?
> 
> 	I see a time like that, my gut suspicion for the shutdown is
> "something drive y a cro job".
> 
> 
> 			Robert Huff

.......

I've looked at the various cron jobs and cannot see anything that looks 
suspicious. Root only has an ntp job which runs at 01:17. The one other 
user with a crontab has jobs running at *:19 and 03:13. Looked in 
/var/crash and see minfree from 2005.
-- 
Robin Becker