LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 10-29-2006, 04:27 PM   #1
ganz_friedrich
Member
 
Registered: Dec 2005
Posts: 47

Rep: Reputation: 16
What triggered the restart?


Hi,

I was ssh'd into my server and there was a broadcast that the server was restarting. How can I find out what triggered the restart?

I checked messages and the cron log and I could not find anything significant. The cron log had (around the time of restart):

Oct 29 14:26:41 host crond[2487]: (CRON) STARTUP (V5.0)
Oct 29 14:26:42 host anacron[2527]: Anacron 2.3 started on 2006-10-29
Oct 29 14:26:43 host anacron[2527]: Normal exit (0 jobs run)
Oct 29 14:30:01 host crond[3277]: (root) CMD (/usr/local/sbin/bfd -q)
Oct 29 14:30:01 host crond[3278]: (root) CMD (/usr/local/lp/apps/autoupdate/lp-autoupdate.pl > /dev/null 2>&1)
Oct 29 14:30:01 host crond[3279]: (root) CMD (/usr/lib/sa/sa1 1 1)

Thanks
 
Old 10-29-2006, 08:50 PM   #2
trickykid
LQ Guru
 
Registered: Jan 2001
Posts: 24,149

Rep: Reputation: 261Reputation: 261Reputation: 261
Any one else have access? Who was logged in at that time? Nothing usually triggers a restart unless it's a cron job or another user restarts the machine.
 
Old 10-30-2006, 02:54 AM   #3
ganz_friedrich
Member
 
Registered: Dec 2005
Posts: 47

Original Poster
Rep: Reputation: 16
Thanks for writing.

I don't think it was anyone else, but where can I check?

I think the broadcast said it was root (I was logged in as root) - obviously I didn't do it manually, so I guess that only leaves crontab. But the only cron job under user root that could possibly trigger a reboot is a yum update command but that wasn't scheduled at the time.

Any ideas how i could investigate?

Thank you.
 
Old 10-30-2006, 02:57 AM   #4
ganz_friedrich
Member
 
Registered: Dec 2005
Posts: 47

Original Poster
Rep: Reputation: 16
I should mention - and you can probably tell from the cron log - that the unknown restart happened almost immediately after a restart which was done manually.
 
Old 10-30-2006, 10:30 AM   #5
timmeke
Senior Member
 
Registered: Nov 2005
Location: Belgium
Distribution: Red Hat, Fedora
Posts: 1,515

Rep: Reputation: 61
Quote:
I think the broadcast said it was root (I was logged in as root) - obviously I didn't do it manually, so I guess that only leaves crontab. But the only cron job under user root that could possibly trigger a reboot is a yum update command but that wasn't scheduled at the time.
The "shutdown" command, used to halt or restart the machine, should be usable by root only (it's in /sbin typically). So, it's normal that you see that "root" issued the shutdown command that triggered the automatic warnings to all logged on users. Secondly, multiple people can login as root (or login and then su to root) at the same time, so regardless if you are logged in as root, it's still possible that someone else has done the same.

So, my guess is that someone else was also logged in as root and they executed the shutdown for some reason.
There's no telling why, though.
 
Old 10-30-2006, 01:48 PM   #6
ganz_friedrich
Member
 
Registered: Dec 2005
Posts: 47

Original Poster
Rep: Reputation: 16
Thanks for your help.

No one else could have had access to the server because only i have the root password. Can the datacenter trigger a reboot without access?

Regardless, how can I find out who or what actually did it - this must be logged somewhere!?

Thank you.
 
Old 10-31-2006, 12:12 AM   #7
jon_k
Member
 
Registered: Jul 2003
Location: Fort Worth, Texas
Distribution: Mepis Linux 2004
Posts: 547

Rep: Reputation: 30
It is. Check /var/log/auth.log, it'll show everyone who has logged in to the machine and also anyone who su'd to become root from a normal user.

You can start there, also lots of other informative logs are kept there.
 
Old 11-04-2006, 06:56 PM   #8
ganz_friedrich
Member
 
Registered: Dec 2005
Posts: 47

Original Poster
Rep: Reputation: 16
Thank you very much - I will check it out.

Maybe you could make a suggestion for my other problem:

http://www.linuxquestions.org/questi...d.php?t=496698
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Cluster F/S: Network raid? OpenAFS? CODA? Fam / Imon triggered Rsync? GuitsBoy Linux - Server 0 10-26-2006 08:46 PM
ALSA troubles, triggered by CPU usage? Hunter2 Linux - Software 1 06-11-2006 05:15 PM
SSH tunnel triggered by xinetd, error blondie72 Linux - Networking 0 01-19-2006 03:57 AM
Action triggered by illegal applications. rblampain Linux - Security 4 08-09-2005 09:01 AM
executing a time-triggered script leosuth Programming 7 06-02-2004 08:15 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 08:46 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration