System shutting down nicely for no reason

gmartin · 03-11-2011, 09:33 AM

My Slackware 13.1 PC is hutting itself down every couple days. Found this in the log this morning

Code:

Mar 11 01:57:39 Uslack nagios: Auto-save of retention data completed successfully.
Mar 11 02:03:12 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:03:12 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:03:15 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:03:15 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:03:20 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:03:20 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:05:25 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:05:26 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:05:29 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:05:29 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:05:34 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:05:34 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:05:37 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 213.241.70.5#53
Mar 11 02:05:37 Uslack named[2068]: unexpected RCODE (REFUSED) resolving '98.60.241.213.in-addr.arpa/PTR/IN': 212.106.7.2#53
Mar 11 02:06:43 Uslack shutdown[27330]: shutting down for system halt
Mar 11 02:06:45 Uslack /usr/sbin/gpm[2345]: *** info [mice.c(1766)]: 
Mar 11 02:06:45 Uslack /usr/sbin/gpm[2345]: imps2: Auto-detected intellimouse PS/2
Mar 11 02:06:45 Uslack sshd[27323]: Failed password for root from 94.198.193.148 port 22042 ssh2
Mar 11 02:06:45 Uslack init: Switching to runlevel: 0
Mar 11 02:06:47 Uslack sshd[27336]: Failed password for root from 94.198.193.148 port 22179 ssh2
Mar 11 02:06:47 Uslack nagios: Caught SIGTERM, shutting down... 
Mar 11 02:06:47 Uslack nagios: Successfully shutdown... (PID=2381)
Mar 11 02:06:48 Uslack sshd[27342]: Failed password for root from 94.198.193.148 port 22288 ssh2
Mar 11 02:06:49 Uslack sshd[27353]: Failed password for root from 94.198.193.148 port 22364 ssh2
Mar 11 02:06:51 Uslack sshd[27397]: Failed password for root from 94.198.193.148 port 22534 ssh2
Mar 11 02:06:52 Uslack sshd[27400]: Failed password for root from 94.198.193.148 port 22671 ssh2
Mar 11 02:06:54 Uslack sshd[27404]: Failed password for root from 94.198.193.148 port 22810 ssh2
Mar 11 02:06:55 Uslack sshd[27408]: Failed password for root from 94.198.193.148 port 22962 ssh2
Mar 11 02:06:55 Uslack sshd[2065]: Received signal 15; terminating.
Mar 11 02:06:56 Uslack saslauthd[2198]: server_exit     : master exited: 2198
Mar 11 02:06:59 Uslack logger: /etc/rc.d/rc.inet1:  /sbin/route del default
Mar 11 02:06:59 Uslack logger: /etc/rc.d/rc.inet1:  /sbin/ifconfig eth0 down
Mar 11 02:06:59 Uslack logger: /etc/rc.d/rc.inet1:  /sbin/ifconfig lo down
Mar 11 02:06:59 Uslack acpid: exiting 
Mar 11 02:06:59 Uslack exiting on signal 15

I found this in the secure log

Code:

Mar 11 02:06:26 Uslack polkitd(authority=local): Unregistered Authentication Agent for session /org/freedesktop/ConsoleKit/Session1 (system bus name :1.17, object path /org/kde/PolicyKit1/AuthenticationAgent, locale en_US)

I also checked debug, syslog but found no related information

How do I find out what initiated the system halt at 02:06:43?

business_kid · 03-11-2011, 10:13 AM

Can't point you directly, but I can suggest something.
I would rename /sbin/shutdown to something_weird.

Put a script as /sbin/shutdown, which
1. Executes 'whoami > some_file',
2. runs pstree [options] >> some_file
and asks for keyboard confirmation
"Are you Sure you want to shut this thing down now? Y/N"
and acts accordingly passing on $1, $2, etc to shutdown.

That way You may get a clue what is going on, as you should catch user & process. Won't try helping on the script; I'm more of a liability in that area.

gmartin · 03-11-2011, 10:15 AM

I like it.

Off to write me some bash...