How to know when was an ethernet wire fisically unplugged from a server?

dariosilvestre · 01-02-2007, 04:54 PM

Hello, I'm experienced in Linux for only 2 years, and I would like to know if it's possible to know the date and time when an ethernet wire was unplugged from a server. This server is running Apache2, Tomcat 4.1.31, MySQL 4 and ProFTPd. The kernel version is 2.6.12-10.

Somebody removed the ethernet connection from a server in my office and I would like to know at what date and time he did it.

Can somebody help me?

Thank you.

raskin · 01-02-2007, 05:05 PM

dmesg | grep 'down'
If you have timestamps in dmesg - you'll have time in seconds since system boot. Maybe logs of servers, who stopped getting connections at the same time will make something clear.

win32sux · 01-02-2007, 06:06 PM

this typically gets logged to the /var/log/messages file...

for example, i just quickly unplugged a cable from one of my NICs and in /var/log/messages i can see this:

Code:

Jan  2 19:05:19 localhost kernel: [30618.307845] eth0: Media Link Off
Jan  2 19:05:29 localhost kernel: [30628.297771] eth0: Media Link On 100mbps full-duplex

as you can see, the time and date are clearly printed...

dariosilvestre · 01-03-2007, 04:52 PM

Thank you very much for your help.

I found the logged record in the file /var/log/messages and in the file /var/log/kern.log as a "NIC link is Down" error message.

Thanks a lot.