topic Re: Shutdown ?? in Operating System - HP-UX

Shutdown ??

Amit Dixit_2 — Wed, 28 Jul 2004 00:29:14 GMT

Hi,
Please check the attached log and tell me
why the system went shutdown.

Also, What is that EMS MAJORWARNING and how
to check details for the same can i execute
the command given on the log at any
runlevel ?

Thanks
Amit

Re: Shutdown ??

Jeroen Peereboom — Wed, 28 Jul 2004 00:39:14 GMT

Amit,

no idea why your system shut down.
EMS is Event Monitoring System that monitors the hardware (or at least generates messages for hardware problems. You can run the command specified from all (?) runlevels, just be sure the filesystems needed are mounted.

JP.

Re: Shutdown ??

Michael Tully — Wed, 28 Jul 2004 00:42:39 GMT

Check the /etc/shutdownlog for any details.
Normally this message is not written to the syslog by default.

Re: Shutdown ??

Con O'Kelly — Wed, 28 Jul 2004 00:42:58 GMT

Hi Amit

There is not really enough detail in syslog.log to determine the cause of the system shutdown.

Firstly check /etc/shutdownlog for any entries. System panics will usually write to this file.

There should also be a crash dump in /var/adm/crash and there should also be some files in /var/tombstones that can used for analysis (eg ts99).

Analysing the reason for a system crash usually requires some in depth knowledge of HP-UX. If your system has crashed you should log a call with HP or whichever organisation provides support for your systems.

There are multiple reasons for system crashes such as hardware failures (HPMC)or software failures which initiate a system PANIC.

Post any entries from /etc/shutdownlog.

Cheers
Con

Re: Shutdown ??

Amit Dixit_2 — Wed, 28 Jul 2004 00:51:06 GMT

Hi,
The file /etc/shutdownlog is having entry
11:39 Sun Jun 20, 2004. Halt:(by lcsweb4!root)

Does that means somebody has given HALT
command.

Thanks,
Amit

Re: Shutdown ??

Con O'Kelly — Wed, 28 Jul 2004 01:01:57 GMT

Yes that is telling you someone shutdown the system at 11:39 on Sun 20 June. Is this the last entry in /etc/shutdownlog??
It appears your system was also shutdown on June 25?? Check /var/adm/crash for entries.

Cheers
Con

Re: Shutdown ??

Michael Tully — Wed, 28 Jul 2004 01:02:33 GMT

Yes

That means somebody shutdown the system, not reboot. Check the crontab file for any entries. If you don't know who did it after not finding anything, change your root password, and check any entries in your sudo file and wait to see who complains.
Also have a look in the /var/adm/sulog for valid entries around the same time.

Re: Shutdown ??

Amit Dixit_2 — Wed, 28 Jul 2004 02:20:04 GMT

Hi,
How can I disable shutdown from root and
create a different account to shutdown the
system.

Thanks,
Amit

Re: Shutdown ??

Con O'Kelly — Wed, 28 Jul 2004 18:54:01 GMT

Hi

Use the /etc/shutdown.allow file to permit other users to shutdown the system.

See man 1m shutdown for details on configuring /etc/shutdown.allow file.

Cheers
Con