server rebooted

manoj.linux · 01-26-2009, 01:19 AM

Hi,

I want to know by which command I will get the information that which user has rebooted the server?

I have used the last command but not getting sufficient information it is showing only "rebooting"

Regards,

Manoj

deepsix · 01-26-2009, 01:59 AM

what shell is being used?...if its bash then you might need to be root and check everyones ".bash_history" file (unless they deleted it) it could give you a lead to who and what command
was used.
again it depends on the shell.... if you can su to other users and are using bash the "history" command can do the same thing.

manoj.linux · 01-26-2009, 07:17 AM

Quote:

Originally Posted by deepsix

what shell is being used?...if its bash then you might need to be root and check everyones ".bash_history" file (unless they deleted it) it could give you a lead to who and what command
was used.
again it depends on the shell.... if you can su to other users and are using bash the "history" command can do the same thing.

Thanks deepsix for quick response, users are using bash shell only. I have already checked history also but did not find any reboot or shutdown -Fr command.

is it possible that whenever anyuser is giving command shutdown or reboot that can be captured (output is redirected to file)

or we can limit the shutdown or reboot to particular system only. So that particular system can reboot or shutdown.

Regards,

Manoj

deepsix · 02-02-2009, 01:42 AM

there could be a simple way to change this with a pretty GUI.......or maybe we have to change some config files...

either way you can set a server up to only be rebooted by root users...unless someone has direct access to the machine.
if thats the case .... let me know.

deepsix · 02-02-2009, 01:56 AM

btw.....how big is your network ... are we talking 2 computers or 100....and server info is important.

crabboy · 02-02-2009, 03:43 PM

have you checked the error report (errpt)? it's likely that the machine is having trouble and rebooting on its own.

pete83 · 02-04-2009, 09:33 AM

if you type: `errpt -a | more` and serach for SYSPROC or SHUTDOWN you will see if the system was halted by it self or by a user. In the example below the root user rebooted the server.

Resource Name: SYSPROC

Description
SYSTEM SHUTDOWN BY USER

Probable Causes
SYSTEM SHUTDOWN

Detail Data
USER ID
0