From owner-freebsd-questions@FreeBSD.ORG  Thu Sep 18 00:16:23 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6775C106564A
	for <freebsd-questions@freebsd.org>;
	Thu, 18 Sep 2008 00:16:23 +0000 (UTC)
	(envelope-from gpeel@thenetnow.com)
Received: from thenetnow.com (thenetnow.com [69.90.69.141])
	by mx1.freebsd.org (Postfix) with ESMTP id 40DAF8FC17
	for <freebsd-questions@freebsd.org>;
	Thu, 18 Sep 2008 00:16:23 +0000 (UTC)
	(envelope-from gpeel@thenetnow.com)
Received: from hpeel.ody.ca ([216.240.12.2] helo=GRANT)
	by constellation.thenetnow.com with esmtpa (Exim 4.63 (FreeBSD))
	(envelope-from <gpeel@thenetnow.com>) id 1Kg7C1-00048r-8b
	for freebsd-questions@freebsd.org; Wed, 17 Sep 2008 20:16:21 -0400
Message-ID: <FD15F879D39E42B3BCF6CCD3F809571A@GRANT>
From: "Grant Peel" <gpeel@thenetnow.com>
To: <freebsd-questions@freebsd.org>
Date: Wed, 17 Sep 2008 20:16:13 -0400
Organization: The Net Now
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset="iso-8859-1";
	reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
Subject: Mystical Server Shutdown.
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Grant Peel <gpeel@thenetnow.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Sep 2008 00:16:23 -0000

Hi all,

I started getting watchmouse errors about on pf my servers not responding. 
There is a DRAC on the machine, and the sensor data was all good. When I got 
the machine back up and running, I seen this in lastlog:

client1         ftp      hostname1here  Wed Sep 17 17:02 - shutdown  (00:46)
client2         ftp      hostname2here  Wed Sep 17 17:02 - shutdown  (00:46)
client2         ftp      hostname2here  Wed Sep 17 17:02 - shutdown  (00:46)
client3         ftp      hostname3here  Wed Sep 17 17:01 - 17:06  (00:04)


Should I be worried about seeing 'shutdown' in an ftp line of last?

If not, how would you suggest I find the process or program that issued the 
shutdown command?

-Grant