From owner-freebsd-questions@FreeBSD.ORG Thu Sep 18 07:09:48 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E7603106566B for ; Thu, 18 Sep 2008 07:09:48 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from smtp.infracaninophile.co.uk (gate6.infracaninophile.co.uk [IPv6:2001:8b0:151:1::1]) by mx1.freebsd.org (Postfix) with ESMTP id 53C918FC15 for ; Thu, 18 Sep 2008 07:09:48 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost [IPv6:::1]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.3/8.14.3) with ESMTP id m8I79gAg057126; Thu, 18 Sep 2008 08:09:44 +0100 (BST) (envelope-from m.seaman@infracaninophile.co.uk) X-DKIM: Sendmail DKIM Filter v2.7.1 smtp.infracaninophile.co.uk m8I79gAg057126 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=infracaninophile.co.uk; s=200708; t=1221721784; bh=UV0DiMOX8XgBGZ u5Pqi1EGNR8uW7kj642xAnecL6IC0=; h=Message-ID:Date:From:MIME-Version: To:CC:Subject:References:In-Reply-To:Content-Type:Cc:Content-Type: Date:From:In-Reply-To:Message-ID:Mime-Version:References:To; z=Mes sage-ID:=20<48D1FEB0.6060903@infracaninophile.co.uk>|Date:=20Thu,=2 018=20Sep=202008=2008:09:36=20+0100|From:=20Matthew=20Seaman=20|Organization:=20Infracaninophile|User -Agent:=20Thunderbird=202.0.0.16=20(X11/20080726)|MIME-Version:=201 .0|To:=20Grant=20Peel=20|CC:=20freebsd-questio ns@freebsd.org|Subject:=20Re:=20Mystical=20Server=20Shutdown.|Refer ences:=20|In-Reply-To:=20|X-Enigmail-Version:=200.95.6 |Content-Type:=20multipart/signed=3B=20micalg=3Dpgp-sha256=3B=0D=0A =20protocol=3D"application/pgp-signature"=3B=0D=0A=20boundary=3D"-- ----------enigAE5D79A99A3B14E7E92CD47A"; b=U3mMtoyLCWUZ4L4cWQjSW0N7 dXaj/fgWWWK740jpT/ClvUnTNECMABSpQoUH1ykq0GMcKZ/Tb89Gf6Xi9+SpOH55xYL DyS1/QGjgb4p4PCXT7Df/fUUrjoRk3phwCeqMAzacejP8FpT8fkdJ8BVTD06+0+F0Mc HLz0zMCRm90M4= Message-ID: <48D1FEB0.6060903@infracaninophile.co.uk> Date: Thu, 18 Sep 2008 08:09:36 +0100 From: Matthew Seaman Organization: Infracaninophile User-Agent: Thunderbird 2.0.0.16 (X11/20080726) MIME-Version: 1.0 To: Grant Peel References: In-Reply-To: X-Enigmail-Version: 0.95.6 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------enigAE5D79A99A3B14E7E92CD47A" X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (smtp.infracaninophile.co.uk [IPv6:::1]); Thu, 18 Sep 2008 08:09:44 +0100 (BST) X-Virus-Scanned: ClamAV 0.93.3/8275/Thu Sep 18 02:16:55 2008 on happy-idiot-talk.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-3.0 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VERIFIED,NO_RELAYS autolearn=ham version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on happy-idiot-talk.infracaninophile.co.uk Cc: freebsd-questions@freebsd.org Subject: Re: Mystical Server Shutdown. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Sep 2008 07:09:49 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigAE5D79A99A3B14E7E92CD47A Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Grant Peel wrote: > Hi all, >=20 > I started getting watchmouse errors about on pf my servers not=20 > responding. There is a DRAC on the machine, and the sensor data was all= =20 > good. When I got the machine back up and running, I seen this in lastlo= g: >=20 > client1 ftp hostname1here Wed Sep 17 17:02 - shutdown =20 > (00:46) > client2 ftp hostname2here Wed Sep 17 17:02 - shutdown =20 > (00:46) > client2 ftp hostname2here Wed Sep 17 17:02 - shutdown =20 > (00:46) > client3 ftp hostname3here Wed Sep 17 17:01 - 17:06 (00:0= 4) >=20 >=20 > Should I be worried about seeing 'shutdown' in an ftp line of last? That just means the ftp user was still logged in at the time the system shut down. > If not, how would you suggest I find the process or program that issued= =20 > the shutdown command? Read the system logs, basically. /var/log/messages or /var/log/all.log (if you've enabled it). The shutdown(8) command will always write syslog messages when invoked. halt(8) or reboot(8) will write a 'shutdow= n' record into wtmp (ie. look at 'last shutdown') but don't log anything to syslog. However, you're quite likely to find that there is nothing in the log or wtmp files to explain what happened. All this means is that the system went down suddenly -- perhaps power dropped out momentarily, or a thermal cutout tripped or the system panic'd for one of any number of=20 reasons. You'ld be able to detect log file traces showing fsck(8) being run on the root f/s following any of those sort of unclean shutdown= s, and if the system panic'd then you may well have a core dump sitting i= n /var/db/crash -- depends whether you've enabled that functionality or n= ot. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW --------------enigAE5D79A99A3B14E7E92CD47A Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEAREIAAYFAkjR/rYACgkQ8Mjk52CukIw8WgCfeltPYrlZNC2xJ6kKbGo+Z0dW lUAAnRJ8rb1sfD9ahG5i2aSfDs4Xyn50 =bXpq -----END PGP SIGNATURE----- --------------enigAE5D79A99A3B14E7E92CD47A--