topic Re: Phantom reboot? in Operating System - HP-UX

Phantom reboot?

Jason Moorhead_2 — Mon, 03 Feb 2003 16:06:25 GMT

Hi all,

A very odd thing happened over the weekend... the syslog and sulog were reset and restarted, as if a reboot occured. An 'uptime' command on Sunday came back with an uptime of 1 day, also indicating a reboot. But the rbootd.log and STM show no reboot happened. Anyone ever seen this before, or know where else to look? Our application logs show nothing abnormal. Thanks!

Re: Phantom reboot?

Pete Randall — Mon, 03 Feb 2003 16:08:52 GMT

Jason,

Do a "ps -ef |grep init" and see what the timestamp is on the init process. That's a sure indication of a reboot.

Pete

Re: Phantom reboot?

Ken Hubnik_2 — Mon, 03 Feb 2003 16:10:18 GMT

YEP, HP suspects a bug in the GSP firmware. They released version B.02.15 in December and was suppose to fix the problem but phamtom reboots were still occuring. They have sinced release B.02.17 on Jan 13th and they beleive it has resolved the problem.

Re: Phantom reboot?

Marco Santerre — Mon, 03 Feb 2003 16:12:33 GMT

You may want to check your GSP logs, they would indicate possible problems or shutdown.

Once on the GSP, do a SL, and check for errors. If the machine shut down on its own, chances are you will find an error log in here.

Re: Phantom reboot?

harry d brown jr — Mon, 03 Feb 2003 16:13:08 GMT

What does "dmesg" report?

What messages are in the syslog "log" files?

live free or die
harry

Re: Phantom reboot?

Jeff Schussele — Mon, 03 Feb 2003 16:15:59 GMT

Hi Jason,

What does the /etc/shutdownlog show?

Did a tombstone get created?

Rgds,
Jeff

Re: Phantom reboot?

Stanimir — Mon, 03 Feb 2003 16:26:27 GMT

Hi!
As far as I know rbootd is remote-boot-daemon,
but bootpd is BOOT-daemon, ruled by inetd.
So I suppose you had real reboot for
some reason.
Anyway you can use bootpquery for test-needs,
see man bootpquery.
And also it is not a bad idea to edit your shutdown.allow & shutdown.deny files.
Regards,Stan

Re: Phantom reboot?

Steven E. Protter — Mon, 03 Feb 2003 16:30:19 GMT

This kind of activity can be the sign of several issues:

1) Power supply UPS issues. Check that these are working.
2) Possible security breach. I'd reset the root password, check the wtmp and btmp with the last and lastb commands and be very vigilant.

If physical and network security is good, its more likely to be in the realm of item 1. The prior posts should help you track it down.

P

Re: Phantom reboot?

Jason Moorhead_2 — Mon, 03 Feb 2003 16:34:47 GMT

The shutdownlog shows no reboot for the time we suspect. Unfortunately, I actually did a reboot yesturday (Sunday), so getting the timestamp on the init process won't help.

I'm not very familiar with using the GSP. What exactly would I do with it to help troubleshoot this?

Thanks again!

Re: Phantom reboot?

Marco Santerre — Mon, 03 Feb 2003 18:42:18 GMT

Jason,

to access the GSP, you have to go on your console (LAN, serial, or web). You enter your Service processor login and password. Then you press the Ctrl-B and you are at the GSP prompt. Once there, you type SL to access your Chassis Logs. I would select Errors. On the GSP if you need help, you can always type HE. Once you are done, you type in CO to go back to console Mode.