From owner-freebsd-questions@FreeBSD.ORG  Sun Apr 27 13:15:58 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E915B106564A
	for <freebsd-questions@freebsd.org>;
	Sun, 27 Apr 2008 13:15:58 +0000 (UTC)
	(envelope-from roberthuff@rcn.com)
Received: from smtp02.lnh.mail.rcn.net (smtp02.lnh.mail.rcn.net
	[207.172.157.102])
	by mx1.freebsd.org (Postfix) with ESMTP id 9C0A48FC1C
	for <freebsd-questions@freebsd.org>;
	Sun, 27 Apr 2008 13:15:58 +0000 (UTC)
	(envelope-from roberthuff@rcn.com)
Received: from mr08.lnh.mail.rcn.net ([207.172.157.28])
	by smtp02.lnh.mail.rcn.net with ESMTP; 27 Apr 2008 09:15:58 -0400
Received: from smtp01.lnh.mail.rcn.net (smtp01.lnh.mail.rcn.net [207.172.4.11])
	by mr08.lnh.mail.rcn.net (MOS 3.8.6-GA) with ESMTP id JWO11690;
	Sun, 27 Apr 2008 09:15:57 -0400 (EDT)
Received: from 209-6-22-188.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com (HELO
	jerusalem.litteratus.org.litteratus.org) ([209.6.22.188])
	by smtp01.lnh.mail.rcn.net with ESMTP; 27 Apr 2008 09:15:45 -0400
From: Robert Huff <roberthuff@rcn.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <18452.31872.825011.919326@jerusalem.litteratus.org>
Date: Sun, 27 Apr 2008 09:15:44 -0400
To: Robin Becker <robin@reportlab.com>
In-Reply-To: <481441DC.60103@jessikat.plus.net>
References: <481441DC.60103@jessikat.plus.net>
X-Mailer: VM 7.17 under 21.5  (beta28) "fuki" XEmacs Lucid
X-Junkmail-Whitelist: YES (by domain whitelist at mr08.lnh.mail.rcn.net)
Cc: freebsd-questions@freebsd.org
Subject: shutdown forensics
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Apr 2008 13:15:59 -0000


Robin Becker writes:
>  I'm trying to figure out what caused an unplanned shutdown of a
>  freebsd 6.0 server; I see this in the last output
>  
>  reboot           ~                         Thu Apr 24 06:15
>  shutdown         ~                         Thu Apr 24 06:10
>  
>  but cannot see anybody having been logged in at the time. Is
>  there any way I can trace the origin of the shutdown command?

	I see a time like that, my gut suspicion for the shutdown is
"something drive y a cro job".


			Robert Huff


































































































































































































































































>  
>  I looked in the root shell history various other logs, but couldn't see 
>  anything obvious.