Mystical Server Shutdown.

[Grant Peel]

Hi all,

I started getting watchmouse errors about on pf my servers not responding. 
There is a DRAC on the machine, and the sensor data was all good. When I got 
the machine back up and running, I seen this in lastlog:

client1         ftp      hostname1here  Wed Sep 17 17:02 - shutdown  (00:46)
client2         ftp      hostname2here  Wed Sep 17 17:02 - shutdown  (00:46)
client2         ftp      hostname2here  Wed Sep 17 17:02 - shutdown  (00:46)
client3         ftp      hostname3here  Wed Sep 17 17:01 - 17:06  (00:04)


Should I be worried about seeing 'shutdown' in an ftp line of last?

If not, how would you suggest I find the process or program that issued the 
shutdown command?

-Grant