FreeBSD-7 reboots hourly

[Jeff Kletsky]

I had a similar puzzle to unravel with a CentOS (RHEL equivalent) box. 
The clues there were in the log files that showed that gdm was exec-ing 
shutdown. I'm not suggesting that is the answer here, but looking at 
your logs may help.

While the CentOS shutdown process is different than FreeBSD, you might 
get some use out of "wrapping" the commands that shutdown the box to see 
who called them. The script below worked for CentOS and probably needs 
some modification for FreeBSD, but the idea is to log the caller (and 
caller's caller) of all the executables that are used to 
shutdown/halt/reboot etc. the system.

(Note that this one errors in ps if there isn't a ppid at one of the 
levels, but it doesn't seem to hurt anything and could be cleaned up 
with a check of the ppid variables used).

This is a ***CentOS*** script -- use for concept with FreeBSD

$ cat /sbin/shutdown
#!/bin/bash
### Log who is calling a program
###
### Program to be executed
###
true_executable="/sbin/shutdown.orig"
#
# Helper commands
#
ps="/bin/ps --noheaders"
logger="/usr/bin/logger -t $0[$$]"
#
this_ps_line=`${ps} up $$`;
# Get parent
this_ppid=`${ps} -p $$ -o ppid=`;
ppid_ps_line=`${ps} up ${this_ppid}`
# And parent's parent
ppid_ppid=`${ps} -p ${this_ppid} -o ppid=`;
ppid_ppid_ps_line=`${ps} up ${ppid_ppid}`;
${logger} "Called by: ${ppid_ps_line}"
${logger} "w/ parent: ${ppid_ppid_ps_line}"
${logger} "Remaining parameters: $@"
exec ${true_executable} $@