From owner-freebsd-questions@FreeBSD.ORG Fri Sep 19 02:08:47 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3AE1A1065670 for ; Fri, 19 Sep 2008 02:08:47 +0000 (UTC) (envelope-from kitchetech@gmail.com) Received: from rv-out-0506.google.com (rv-out-0506.google.com [209.85.198.237]) by mx1.freebsd.org (Postfix) with ESMTP id 06BCB8FC08 for ; Fri, 19 Sep 2008 02:08:46 +0000 (UTC) (envelope-from kitchetech@gmail.com) Received: by rv-out-0506.google.com with SMTP id b25so182024rvf.43 for ; Thu, 18 Sep 2008 19:08:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type:references; bh=bo9b87qJJX3VdklW/xC0KJiq3sW3u7pV4jFxvDbFQQQ=; b=WkGQOG1wt1mHUHtaIPqVTP73JmOuhNrktCHQu1G0EBYvSU4JPJi+KJzEwoal8GbE90 Sjg/r6JcLpoOQVlufEuD+pHl0v6NgtCgG8FaubB5s9g71edWm13OD4Tw4xaZv61fqX1t ITmVKRRlAdiTxNg7RR/BPzpP14UIJa6GaO1rM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:references; b=TGhAY/IsEJZ4HhVeupwzI473z4Uvkp6xYP/rqx1/mO8gvQKH2HOslxmmehM9xw/dw1 OIFs6kmMyfEsrOiSKsKKacBAGShSjOQdMXDI6ZmGKZWtAGPWOc/0EwEWS5r34n41MLMe leyZrJpVpmeStB5+oJdShNX48Ru0JtlVmM2zc= Received: by 10.142.162.5 with SMTP id k5mr1742970wfe.260.1221790125148; Thu, 18 Sep 2008 19:08:45 -0700 (PDT) Received: by 10.142.231.14 with HTTP; Thu, 18 Sep 2008 19:08:45 -0700 (PDT) Message-ID: <28283d910809181908xd45d516wa1705b7db1019016@mail.gmail.com> Date: Thu, 18 Sep 2008 22:08:45 -0400 From: "matt donovan" To: "Grant Peel" In-Reply-To: MIME-Version: 1.0 References: <48D1FEB0.6060903@infracaninophile.co.uk> <48D21FFE.5090109@sepehrs.com> X-Mailman-Approved-At: Fri, 19 Sep 2008 11:14:20 +0000 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: "H.fazaeli" , freebsd-questions@freebsd.org Subject: Re: Mystical Server Shutdown. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Sep 2008 02:08:47 -0000 On Thu, Sep 18, 2008 at 8:52 PM, Grant Peel wrote: > Hi H, and Matt, and all, > > I had instigated all.log, and here is what happened at 04:08 EDT this > morning...any clues you see here? > > ... > Sep 18 04:04:08 defiant named[601]: unexpected RCODE (SERVFAIL) resolving ' > examplewhole.com/NS/IN': 192.168.0.3#53 > Sep 18 04:08:14 defiant syslogd: restart > Sep 18 04:08:14 defiant syslogd: kernel boot file is /boot/kernel/kernel > Sep 18 04:08:14 defiant kernel: Copyright (c) 1992-2007 The FreeBSD > Project. > ... > > Lastlog shows nothing of note... > > > mssclien ftp bas7-london14-1 Thu Sep 18 08:58 - 09:04 > (00:05) > reboot ~ Thu Sep 18 04:08 > ringette ftp CPE001310e9a482 Thu Sep 18 00:10 - 00:11 > (00:00) > > -Grant > > > > > > > ----- Original Message ----- From: "H.fazaeli" > To: "Grant Peel" > Cc: > Sent: Thursday, September 18, 2008 5:31 AM > Subject: Re: Mystical Server Shutdown. > > > > >> If you applied all the Matthew's suggestions and it is still a >> mystery, and if server's shutdown is clean, look for a >> a (buggy) user land process that sends SIGUSR2 signal >> to init(1). >> >> >> Matthew Seaman wrote: >> >>> Grant Peel wrote: >>> >>>> Hi all, >>>> >>>> I started getting watchmouse errors about on pf my servers not >>>> responding. There is a DRAC on the machine, and the sensor data was all >>>> good. When I got the machine back up and running, I seen this in lastlog: >>>> >>>> client1 ftp hostname1here Wed Sep 17 17:02 - shutdown >>>> (00:46) >>>> client2 ftp hostname2here Wed Sep 17 17:02 - shutdown >>>> (00:46) >>>> client2 ftp hostname2here Wed Sep 17 17:02 - shutdown >>>> (00:46) >>>> client3 ftp hostname3here Wed Sep 17 17:01 - 17:06 (00:04) >>>> >>>> >>>> Should I be worried about seeing 'shutdown' in an ftp line of last? >>>> >>> >>> That just means the ftp user was still logged in at the time the >>> system shut down. >>> >>> If not, how would you suggest I find the process or program that issued >>>> the shutdown command? >>>> >>> >>> Read the system logs, basically. /var/log/messages or /var/log/all.log >>> (if you've enabled it). The shutdown(8) command will always write >>> syslog messages when invoked. halt(8) or reboot(8) will write a >>> 'shutdown' >>> record into wtmp (ie. look at 'last shutdown') but don't log anything >>> to syslog. >>> >>> However, you're quite likely to find that there is nothing in the log >>> or wtmp files to explain what happened. All this means is that the >>> system went down suddenly -- perhaps power dropped out momentarily, or >>> a thermal cutout tripped or the system panic'd for one of any number of >>> reasons. You'ld be able to detect log file traces showing fsck(8) >>> being run on the root f/s following any of those sort of unclean >>> shutdowns, and if the system panic'd then you may well have a core dump >>> sitting in /var/db/crash -- depends whether you've enabled that >>> functionality or not. >>> >>> Cheers, >>> >>> Matthew >>> >>> >> -- >> >> >> Best regards. >> >> Hooman Fazaeli >> Sepehr S. T. Co. Ltd. >> >> Web: http://www.sepehrs.com >> Tel: (9821)88975701-2 >> Fax: (9821)88983352 >> >> >> >> >> _______________________________________________ >> freebsd-questions@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-questions >> To unsubscribe, send any mail to " >> freebsd-questions-unsubscribe@freebsd.org" >> >> >> > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" > looks like this line looks like this line Sep 18 04:04:08 defiant named[601]: unexpected RCODE (SERVFAIL) resolving 'examplewhole.com/NS/IN': 192.168.0.3#53 and I really need to get off the gmail web interface