From owner-freebsd-questions Thu Nov 14 06:47:57 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id GAA12841 for questions-outgoing; Thu, 14 Nov 1996 06:47:57 -0800 (PST) Received: from login.bigblue.no (root@login.bigblue.no [194.19.68.12]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id GAA12833 for ; Thu, 14 Nov 1996 06:47:53 -0800 (PST) Received: from eagle.bigblue.no (eagle.bigblue.no [194.19.68.13]) by login.bigblue.no (8.7.6/8.7.3) with SMTP id PAA02691 for ; Thu, 14 Nov 1996 15:47:43 +0100 (MET) Message-Id: <199611141447.PAA02691@login.bigblue.no> From: "Frode Nordahl" To: "questions@freebsd.org" Date: Thu, 14 Nov 96 15:47:56 Reply-To: "Frode Nordahl" Priority: Normal X-Mailer: Frode Nordahl's Registered PMMail 1.53 For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Subject: Hackers? Sender: owner-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk Last night, one of our FreeBSD 2.1.5 machines rebooted. There is no entry of it in the messages file, but the lastlog says this xxx ttyp0 xxxx Thu Nov 14 02:11 - 02:13 (00:01) reboot ~ Thu Nov 14 02:01 xxxx ttyp7 xxxxxxxxx Thu Nov 14 00:36 - 00:44 (00:07) (Usernames and hostnames of the entry above/under are scratched out...) As you can see, no one was logged on at the time. The messages file has noe entries of the activity other than the kernel startupmessages. Can a FreeBSD box do this of itself if it gets into trouble? Memory fault, disk fault or something like that? Or do we have reason to believe this is hacker activity? In any case, what should we do??