shutdown forensics

Robert Huff roberthuff at
Sun Apr 27 13:15:59 UTC 2008

Robin Becker writes:
>  I'm trying to figure out what caused an unplanned shutdown of a
>  freebsd 6.0 server; I see this in the last output
>  reboot           ~                         Thu Apr 24 06:15
>  shutdown         ~                         Thu Apr 24 06:10
>  but cannot see anybody having been logged in at the time. Is
>  there any way I can trace the origin of the shutdown command?

	I see a time like that, my gut suspicion for the shutdown is
"something drive y a cro job".

			Robert Huff

>  I looked in the root shell history various other logs, but couldn't see 
>  anything obvious.

More information about the freebsd-questions mailing list