[SOLVED] server restart check

sachin.davra · 05-19-2014, 02:00 AM

Hi,

I am using centos 6 x86. How can i check who restarted server and at what time. i am getting

Code:

[root@swift ~]# who -b
         system boot  2014-05-19 05:40

And

Code:

[root@swift ~]# last reboot
reboot   system boot  2.6.32-358.el6.x Mon May 19 05:40 - 07:49  (02:09)    
reboot   system boot  2.6.32-358.el6.x Wed Apr  2 06:47 - 07:49 (47+01:02)  
reboot   system boot  2.6.32-358.el6.x Fri Feb 28 16:06 - 07:49 (79+14:43)

Could any one help me to explain it and dig into it more.

pan64 · 05-19-2014, 02:24 AM

the last reboot command is ok, you need to know who executed that. Probably it was executed as root, therefore you need to know who was logged in as root that time...

sachin.davra · 05-19-2014, 02:27 AM

Quote:

Originally Posted by pan64

the last reboot command is ok, you need to know who executed that. Probably it was executed as root, therefore you need to know who was logged in as root that time...

How to know who logged in as root and at what time it was restated? could you explain above given outputs.

pan64 · 05-19-2014, 02:31 AM

no, I'm really sorry, but that information is not enough. First you need to check the command last again: who was logged in at all that time

sachin.davra · 05-19-2014, 02:33 AM

Quote:

Originally Posted by pan64

no, I'm really sorry, but that information is not enough. First you need to check the command last again: who was logged in at all that time

Code:

[root@swift ~]# last |more
root     pts/2        gaidl-5015.gai.n Mon May 19 07:42   still logged in   
sachin.d pts/2        gaidl-5015.gai.n Mon May 19 07:40 - 07:42  (00:01)    
root     pts/2        gaidl-5015.gai.n Mon May 19 07:40 - 07:40  (00:00)    
rajkumar pts/1        tugelanew.gai.ne Mon May 19 07:31   still logged in   
sathish. pts/0        tugelanew.gai.ne Mon May 19 07:10   still logged in   
root     pts/0        192.168.0.102    Mon May 19 06:34 - 06:37  (00:03)    
root     pts/0        192.168.0.102    Mon May 19 06:27 - 06:32  (00:04)    
root     pts/1        tugelanew.gai.ne Mon May 19 06:18 - 06:23  (00:05)    
root     pts/0        192.168.0.102    Mon May 19 06:17 - 06:22  (00:04)    
root     pts/2        tugelanew.gai.ne Mon May 19 06:13 - 06:16  (00:03)    
root     pts/1        192.168.0.102    Mon May 19 06:11 - 06:16  (00:05)    
root     pts/0        tugelanew.gai.ne Mon May 19 06:11 - 06:16  (00:05)    
root     pts/0        192.168.0.102    Mon May 19 06:11 - 06:11  (00:00)    
root     pts/0        192.168.0.102    Mon May 19 06:09 - 06:10  (00:00)    
reboot   system boot  2.6.32-358.el6.x Mon May 19 05:40 - 08:31  (02:51)    
rajkumar pts/0        tugelanew.gai.ne Mon May 19 05:17 - crash  (00:23)    
saidha.r pts/0        tugelanew.gai.ne Fri May 16 16:44 - 17:40  (00:56)    
rajkumar pts/9        tugelanew.gai.ne Fri May 16 12:46 - 13:30  (00:43)    
saidha.r pts/7        tugelanew.gai.ne Fri May 16 12:16 - 18:18  (06:02)    
saidha.r pts/9        192.168.3.3      Fri May 16 11:39 - 11:39  (00:00)    
root     pts/8        gaidl-5015.gai.n Fri May 16 11:35 - 13:43  (02:08)

Whan i ran "last" command, i got above output.

pan64 · 05-19-2014, 02:38 AM

So you can see there was only one user logged in before reboot, rajkumar. You can ask him/her if he/she knew something about that reboot. You can also check the files /var/log/auth.log, /var/log/messages, probably you can find something related.