From owner-freebsd-questions@FreeBSD.ORG Thu Sep 18 09:33:36 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BAFE31065670 for ; Thu, 18 Sep 2008 09:33:36 +0000 (UTC) (envelope-from fazaeli@sepehrs.com) Received: from sepehrs.com (www.sepehrs.com [213.217.59.98]) by mx1.freebsd.org (Postfix) with ESMTP id 1F1788FC21 for ; Thu, 18 Sep 2008 09:33:33 +0000 (UTC) (envelope-from fazaeli@sepehrs.com) Received: from [192.168.1.180] ([192.168.1.180]) by sepehrs.com (8.13.6/8.13.6) with ESMTP id m8I9Yjvs066105; Thu, 18 Sep 2008 14:04:46 +0430 (IRDT) (envelope-from fazaeli@sepehrs.com) Message-ID: <48D21FFE.5090109@sepehrs.com> Date: Thu, 18 Sep 2008 13:01:42 +0330 From: "H.fazaeli" User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: Grant Peel References: <48D1FEB0.6060903@infracaninophile.co.uk> In-Reply-To: <48D1FEB0.6060903@infracaninophile.co.uk> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Sepehr-MailScanner-Information: Please contact the ISP for more information X-Sepehr-MailScanner: Found to be clean X-Sepehr-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-4.399, required 5, autolearn=not spam, ALL_TRUSTED -1.80, BAYES_00 -2.60) X-MailScanner-From: fazaeli@sepehrs.com X-Spam-Status: No Cc: freebsd-questions@freebsd.org Subject: Re: Mystical Server Shutdown. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Sep 2008 09:33:36 -0000 If you applied all the Matthew's suggestions and it is still a mystery, and if server's shutdown is clean, look for a a (buggy) user land process that sends SIGUSR2 signal to init(1). Matthew Seaman wrote: > Grant Peel wrote: >> Hi all, >> >> I started getting watchmouse errors about on pf my servers not >> responding. There is a DRAC on the machine, and the sensor data was >> all good. When I got the machine back up and running, I seen this in >> lastlog: >> >> client1 ftp hostname1here Wed Sep 17 17:02 - shutdown >> (00:46) >> client2 ftp hostname2here Wed Sep 17 17:02 - shutdown >> (00:46) >> client2 ftp hostname2here Wed Sep 17 17:02 - shutdown >> (00:46) >> client3 ftp hostname3here Wed Sep 17 17:01 - 17:06 >> (00:04) >> >> >> Should I be worried about seeing 'shutdown' in an ftp line of last? > > That just means the ftp user was still logged in at the time the > system shut down. > >> If not, how would you suggest I find the process or program that >> issued the shutdown command? > > Read the system logs, basically. /var/log/messages or /var/log/all.log > (if you've enabled it). The shutdown(8) command will always write > syslog messages when invoked. halt(8) or reboot(8) will write a > 'shutdown' > record into wtmp (ie. look at 'last shutdown') but don't log anything > to syslog. > > However, you're quite likely to find that there is nothing in the log > or wtmp files to explain what happened. All this means is that the > system went down suddenly -- perhaps power dropped out momentarily, or > a thermal cutout tripped or the system panic'd for one of any number > of reasons. You'ld be able to detect log file traces showing fsck(8) > being run on the root f/s following any of those sort of unclean > shutdowns, and if the system panic'd then you may well have a core > dump sitting in /var/db/crash -- depends whether you've enabled that > functionality or not. > > Cheers, > > Matthew > -- Best regards. Hooman Fazaeli Sepehr S. T. Co. Ltd. Web: http://www.sepehrs.com Tel: (9821)88975701-2 Fax: (9821)88983352