From owner-freebsd-questions@FreeBSD.ORG Sun Apr 27 09:05:36 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 858B7106566B for ; Sun, 27 Apr 2008 09:05:36 +0000 (UTC) (envelope-from robin@reportlab.com) Received: from ptb-relay02.plus.net (ptb-relay02.plus.net [212.159.14.213]) by mx1.freebsd.org (Postfix) with ESMTP id 4BA428FC18 for ; Sun, 27 Apr 2008 09:05:36 +0000 (UTC) (envelope-from robin@reportlab.com) Received: from [87.114.71.222] (helo=[192.168.0.3]) by ptb-relay02.plus.net with esmtp (Exim) id 1Jq2pC-0004Zf-4q for freebsd-questions@freebsd.org; Sun, 27 Apr 2008 10:05:34 +0100 Message-ID: <481441DC.60103@jessikat.plus.net> Date: Sun, 27 Apr 2008 10:05:32 +0100 From: Robin Becker User-Agent: Thunderbird 2.0.0.12 (Windows/20080213) MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Plusnet-Relay: abeae4c7314e820633238d099279d9ee Subject: shutdown forensics X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Apr 2008 09:05:36 -0000 I'm trying to figure out what caused an unplanned shutdown of a freebsd 6.0 server; I see this in the last output reboot ~ Thu Apr 24 06:15 shutdown ~ Thu Apr 24 06:10 but cannot see anybody having been logged in at the time. Is there any way I can trace the origin of the shutdown command? I looked in the root shell history various other logs, but couldn't see anything obvious. -- Robin Becker