From owner-freebsd-questions@FreeBSD.ORG Tue Oct 30 19:46:21 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2C8ED16A421 for ; Tue, 30 Oct 2007 19:46:21 +0000 (UTC) (envelope-from mic@strg.at) Received: from alt.strg.at (alt.strg.at [194.169.246.2]) by mx1.freebsd.org (Postfix) with ESMTP id E2B1313C4BB for ; Tue, 30 Oct 2007 19:46:20 +0000 (UTC) (envelope-from mic@strg.at) Received: from localhost (localhost.strg.at [127.0.0.1]) by alt.strg.at (Postfix) with ESMTP id 247408FEE9 for ; Tue, 30 Oct 2007 20:20:53 +0100 (CET) X-Virus-Scanned: amavisd-new at strg.at Received: from alt.strg.at ([127.0.0.1]) by localhost (alt.strg.at [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8NruQ-GphCTB for ; Tue, 30 Oct 2007 20:20:43 +0100 (CET) Received: from [192.168.0.7] (shift.strg.at [213.235.236.194]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by alt.strg.at (Postfix) with ESMTP id 41BB08FE99 for ; Tue, 30 Oct 2007 20:17:13 +0100 (CET) Message-ID: <4727828E.4000301@strg.at> Date: Tue, 30 Oct 2007 20:14:22 +0100 From: Michael Dosser Organization: strg.at User-Agent: Mozilla-Thunderbird 2.0.0.6 (X11/20071009) MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Subject: Clean shutdown - but who made the shutdown? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Oct 2007 19:46:21 -0000 Hi, I have odd situation with one of our servers: it suddenly shut down to system halt. This is what makes think of that it was a shutdown: Oct 30 18:21:23 xxxxx kernel: Stopping inetd. Oct 30 18:21:23 xxxxx kernel: Shutting down daemon processes: Oct 30 18:21:23 xxxxx ntpd[687]: kernel time sync enabled 6001 Oct 30 18:21:27 xxxxx kernel: . Oct 30 18:21:33 xxxxx last message repeated 6 times Oct 30 18:21:34 xxxxx kernel: daemon process stopped And in fact, the machine was powered off, when I saw it at the datacenter. I powered it on and it came up with no filesystem checks. It was cleanly shut down. We have accounting turned on, but lastcomm does not display any commands like shutdown, halt or init. I suspected that someone could have pressed the power button but I don't see any acpi events in the logs. There is a apcupsd running on that system, but there are no apcupsd.events logged and the battery is fully charged. Can someone give me a hint, where else I could look at to find the culprit? What could be the cause to cleanly shutdown a system off without anything logged by process accounting? Thanks, Mic