From owner-freebsd-questions@FreeBSD.ORG Sun Apr 27 13:33:27 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4EBAC106566C for ; Sun, 27 Apr 2008 13:33:27 +0000 (UTC) (envelope-from robin@reportlab.com) Received: from ptb-relay02.plus.net (ptb-relay02.plus.net [212.159.14.213]) by mx1.freebsd.org (Postfix) with ESMTP id 0BAF18FC12 for ; Sun, 27 Apr 2008 13:33:26 +0000 (UTC) (envelope-from robin@reportlab.com) Received: from [87.114.71.222] (helo=[192.168.0.3]) by ptb-relay02.plus.net with esmtp (Exim) id 1Jq70P-0004D8-26 for freebsd-questions@freebsd.org; Sun, 27 Apr 2008 14:33:25 +0100 Message-ID: <481480A2.7070708@jessikat.plus.net> Date: Sun, 27 Apr 2008 14:33:22 +0100 From: Robin Becker User-Agent: Thunderbird 2.0.0.12 (Windows/20080213) MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: <481441DC.60103@jessikat.plus.net> <18452.31872.825011.919326@jerusalem.litteratus.org> In-Reply-To: <18452.31872.825011.919326@jerusalem.litteratus.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Plusnet-Relay: dc26b82baa999ff2e7c79fad67736e85 Subject: Re: shutdown forensics X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Apr 2008 13:33:27 -0000 Robert Huff wrote: > Robin Becker writes: >> I'm trying to figure out what caused an unplanned shutdown of a >> freebsd 6.0 server; I see this in the last output >> >> reboot ~ Thu Apr 24 06:15 >> shutdown ~ Thu Apr 24 06:10 >> >> but cannot see anybody having been logged in at the time. Is >> there any way I can trace the origin of the shutdown command? > > I see a time like that, my gut suspicion for the shutdown is > "something drive y a cro job". > > > Robert Huff ....... I've looked at the various cron jobs and cannot see anything that looks suspicious. Root only has an ntp job which runs at 01:17. The one other user with a crontab has jobs running at *:19 and 03:13. Looked in /var/crash and see minfree from 2005. -- Robin Becker