Date: Sun, 27 Apr 2008 14:33:22 +0100 From: Robin Becker <robin@reportlab.com> To: freebsd-questions@freebsd.org Subject: Re: shutdown forensics Message-ID: <481480A2.7070708@jessikat.plus.net> In-Reply-To: <18452.31872.825011.919326@jerusalem.litteratus.org> References: <481441DC.60103@jessikat.plus.net> <18452.31872.825011.919326@jerusalem.litteratus.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Robert Huff wrote: > Robin Becker writes: >> I'm trying to figure out what caused an unplanned shutdown of a >> freebsd 6.0 server; I see this in the last output >> >> reboot ~ Thu Apr 24 06:15 >> shutdown ~ Thu Apr 24 06:10 >> >> but cannot see anybody having been logged in at the time. Is >> there any way I can trace the origin of the shutdown command? > > I see a time like that, my gut suspicion for the shutdown is > "something drive y a cro job". > > > Robert Huff ....... I've looked at the various cron jobs and cannot see anything that looks suspicious. Root only has an ntp job which runs at 01:17. The one other user with a crontab has jobs running at *:19 and 03:13. Looked in /var/crash and see minfree from 2005. -- Robin Becker
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?481480A2.7070708>