LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-18-2010, 02:21 AM   #1
your_shadow03
Senior Member
 
Registered: Jun 2008
Location: Germany
Distribution: Slackware
Posts: 1,462
Blog Entries: 6

Rep: Reputation: 51
Server automatically gets shutdown every evening?


My RHEL Machine is a Build server and always gets shutdown / rebooted at around 5:30 every evening. No idea whats going on as developers were unable to connect to the machine since three days. When I am visiting the physical server probably next morning (since last 3 days)its doesn't show anything and all i reboot the machine and it comes up without any issue.Any idea how to troubleshoot?

Last edited by your_shadow03; 02-18-2010 at 02:38 AM.
 
Old 02-18-2010, 03:45 AM   #2
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
Any kind of scheduling? Any logs?
 
Old 02-18-2010, 04:12 AM   #3
i92guboj
Gentoo support team
 
Registered: May 2008
Location: Lucena, Córdoba (Spain)
Distribution: Gentoo
Posts: 4,074

Rep: Reputation: 387Reputation: 387Reputation: 387Reputation: 387
Quote:
Originally Posted by your_shadow03 View Post
My RHEL Machine is a Build server and always gets shutdown / rebooted at around 5:30 every evening. No idea whats going on as developers were unable to connect to the machine since three days. When I am visiting the physical server probably next morning (since last 3 days)its doesn't show anything and all i reboot the machine and it comes up without any issue.Any idea how to troubleshoot?
"Around" doesn't seem too exact to me, so I'd guess it's a hardware problem overall if it's a bit hot around there.

Second, there's always the chance of an intrusion. Shutting down network services and using rkhunter, chkrootkit and clamav is your best bet there. Of course that will only be possible if you are physically there.

Third, be vigilant, specially about temperature. When things start going off at random times for no reason that's as good reason as any other.

Last but not least, turn off crond and any other custom init script.
 
Old 02-18-2010, 05:08 AM   #4
your_shadow03
Senior Member
 
Registered: Jun 2008
Location: Germany
Distribution: Slackware
Posts: 1,462
Blog Entries: 6

Original Poster
Rep: Reputation: 51
Cant it be checked through /var/log/messages?
 
Old 02-18-2010, 06:47 AM   #5
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
It sure should give some hint in /var/log/messages
 
Old 02-18-2010, 08:25 AM   #6
i92guboj
Gentoo support team
 
Registered: May 2008
Location: Lucena, Córdoba (Spain)
Distribution: Gentoo
Posts: 4,074

Rep: Reputation: 387Reputation: 387Reputation: 387Reputation: 387
That entirely depends on how your box is configured. More particularly, the kernel will log something there. The rest is up to the system logger, and that can be configured to log most things or nothing at all.

Also, note that in the particular case of an intrusion there's a very high chance that the traces have been erased or modified to hide anything that could lead you to your attacker. Anyone that's smart enough to break into your system is probably not that dumb not to take that preventive measure.

I already gave you some hints on what to do. You should really be checking them.
 
Old 02-18-2010, 12:22 PM   #7
salasi
Senior Member
 
Registered: Jul 2007
Location: Directly above centre of the earth, UK
Distribution: SuSE, plus some hopping
Posts: 4,064

Rep: Reputation: 894Reputation: 894Reputation: 894Reputation: 894Reputation: 894Reputation: 894Reputation: 894
Do check that something bizarre isn't happening physically. I did once hear a story of a hospital that had bad survival figures on a Friday, particularly. It turned out that on a Friday evening, the cleaner came round with a floor cleaner. Needing somewhere to plug it in, she had to unplug something. Now, she didn't know that it was a life support machine that she was unplugging...

In your case, you can think that things could be worse. I don't know what, in general, the hospital thought...
 
Old 02-18-2010, 05:55 PM   #8
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,417

Rep: Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397
That's definitely been known to happen in offices; had it happen to me once.
What I'd do is sit at the machine at 5pm onwards and run

tail -f /var/log/messages

and

top

in separate xterms. The log files you've got may give you a clue, but simply sitting there is probably going to be quicker in the long run.
Possibly also

tail -f /var/log/audit/audit.log

as well.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How do I make Slackware to shutdown automatically? larsk Linux - General 6 05-25-2007 06:04 AM
Automatically shutdown jsteegh Slackware 3 09-09-2006 12:45 PM
Shutdown Automatically without switching off power sukhen Linux - Newbie 5 02-13-2006 01:24 PM
Automatically running script at shutdown samac Slackware 2 05-14-2005 11:10 AM
Server crashed this evening:( plisken Linux - General 6 10-24-2004 09:20 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 12:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration