From owner-freebsd-questions@FreeBSD.ORG Sat Mar 4 17:50:42 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DD83116A420 for ; Sat, 4 Mar 2006 17:50:42 +0000 (GMT) (envelope-from kdgrills@the-grills.com) Received: from rwcrmhc13.comcast.net (rwcrmhc13.comcast.net [216.148.227.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5EA3C43D49 for ; Sat, 4 Mar 2006 17:50:41 +0000 (GMT) (envelope-from kdgrills@the-grills.com) Received: from srv1.the-grills.com (c-71-57-60-59.hsd1.il.comcast.net[71.57.60.59]) by comcast.net (rwcrmhc13) with SMTP id <20060304175039m13002hmroe>; Sat, 4 Mar 2006 17:50:39 +0000 Received: (qmail 19958 invoked by uid 1001); 4 Mar 2006 17:50:38 -0000 Date: Sat, 4 Mar 2006 11:50:38 -0600 From: "Kelly D. Grills" To: freebsd-questions@freebsd.org Message-ID: <20060304175038.GB752@the-grills.com> Mail-Followup-To: freebsd-questions@freebsd.org References: <20060304174236.GA752@the-grills.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="kXdP64Ggrk/fb43R" Content-Disposition: inline In-Reply-To: <20060304174236.GA752@the-grills.com> X-Operating-System: FreeBSD/6.0-RELEASE (i386) X-PGP-Key: mailto:kdgrills-pgpkey@the-grills.com User-Agent: Mutt/1.5.11 Subject: Re: How to figure out who shutdown box X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2006 17:50:43 -0000 --kXdP64Ggrk/fb43R Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Mar 04, 2006 at 11:42:49AM -0600, Kelly D. Grills wrote: >=20 > Where are you logging security messages? I believe the default is to > /var/log/security Sorry, meant to say auth >=20 > Have a look at /etc/syslog.conf and syslog.conf(5) >=20 > You should see messages such as this in your security log: Again, auth > Mar 1 15:21:38 srv1 shutdown: reboot by kdgrills: =20 --=20 Kelly D. Grills kdgrills@the-grills.com --kXdP64Ggrk/fb43R Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) Comment: PGP key: mailto:kdgrills-pgpkey@the-grills.com iD8DBQFECdNt7inS5LzF7HMRAtqIAKCBkYD/Lv832CU8TZG936p2QQAtLQCcDncQ CnvN86+Ums6jQkHfLiZyxKk= =QMFj -----END PGP SIGNATURE----- --kXdP64Ggrk/fb43R--