topic Shutdown LOG in Operating System - HP-UX

Shutdown LOG

Sampath_4 — Wed, 02 Nov 2005 02:12:29 GMT

My server is getting shutdown automatically .Shutdownlog doesnot show the user responsible for the shutdown. How do i know which user is responsible for the shutdown

Regards,
N.Sampath Kumar

Re: Shutdown LOG

AwadheshPandey — Wed, 02 Nov 2005 02:15:20 GMT

check ur file system first, if any file system is full, then sytem Goes down automaticaly.

check

#dmesg
for any error messages

Awadhesh

Re: Shutdown LOG

Orhan Biyiklioglu — Wed, 02 Nov 2005 02:16:22 GMT

Check /etc/shutdownlog file

hth

Re: Shutdown LOG

Joseph Loo — Wed, 02 Nov 2005 02:20:30 GMT

hi,

what is included in /etc/shutdown.allow, if it is blank, only the root user is allow to bring the system down.

regards.

Re: Shutdown LOG

Sampath_4 — Wed, 02 Nov 2005 02:20:56 GMT

Thanks for your fast response

None of the filesystems are full.

/etc/shutdownlog shows only the timestamp of the shutdown but not the user responsible for the shutdown

Re: Shutdown LOG

Sampath_4 — Wed, 02 Nov 2005 02:23:31 GMT

shutdown.allow is blank ,but i have some users with UID 0, whether they will be able to shutdown the machine

Re: Shutdown LOG

RAC_1 — Wed, 02 Nov 2005 02:26:57 GMT

There might be different reason why server is getting shutdown. do you see anything in syslog.log, in /var/tombstones/ts99 or in dir /var/adm/crash??

Also do you any error with poer supplies. check it through GSP.

Re: Shutdown LOG

RAC_1 — Wed, 02 Nov 2005 02:33:19 GMT

Anybody with uid 0 will be able to shutdown. But this would get logged in shutdownlog, unless some edited it.

It is a bad idea and sysadmin practice to have many accounts with uid. you can check such accounts with logins -d command.

Re: Shutdown LOG

Sampath_4 — Wed, 02 Nov 2005 02:48:12 GMT

There is no /var/tomstones/ts99.

/var/adm/crash doesnt have any dump in the latest date.It is not to abrupt shutdown it is getting shutdown using the reboot command . When i moved the /sbin/reboot to some other name , i am getting sh: reboot not found error in my console.

How to check the power supplies ? How to access GSP

Re: Shutdown LOG

AwadheshPandey — Wed, 02 Nov 2005 02:51:35 GMT

uid 0 is reserve for root, this is a very bad practice to create such other ids with 0 ids, first change these ids with some other ids rather than system reserve ids ie 0-99,
if problem comes again then check any other issue.
syslog.log,
and /var/adm/crash for any new entry

Awadhesh

Re: Shutdown LOG

Ranjith_5 — Wed, 02 Nov 2005 03:04:21 GMT

Hi Sampath,

** Is this a shutdown / reboot?

** Look at /var/adm/syslog/OLDsyslog.log for the reason for shutdown/reboot. syslog.log will be copied to OLDsyslog.log during boot time.

** if you are not able to find the reason of shutdown from shutdownlog please see the time of last boot and see the users who logged on to the system during that time.

try the command

#last -R|more

** Use STM to verify the system health is in safe condition.

Regards,
Syam

Re: Shutdown LOG

Joseph Loo — Wed, 02 Nov 2005 03:11:33 GMT

hi,

as the rest have suggested, not really good practice to have multiple UID 0, but since u have done that...

anyway, do u keep .sh_history file on each user, u may examine that file of those user with UID 0. however, that user may also have clear the "shutdown" command line if he/she is clearing his/her tracks.

regards.

Re: Shutdown LOG

Sandman! — Wed, 02 Nov 2005 04:22:11 GMT

Check the following files/folders:

/var/adm/syslog.log
/var/adm/syslog/OLDsyslog.log
/var/adm/crash/
/etc/shutdownlog
/var/tombstones/ts99

Look for cron jobs that may be causing reboots. Create wrapper scripts for the reboot and shutdown utilities so that you are notified by e-mail whenever they are called.

regards!

Re: Shutdown LOG

Arunvijai_4 — Wed, 02 Nov 2005 04:30:15 GMT

Checking at /var/adm/syslog/syslog.log and revisiting any cronjobs running may also help you.

-Arun

Re: Shutdown LOG

MarkSyder — Wed, 02 Nov 2005 05:40:02 GMT

I suspect this is resolved as you've given a bunny, but just in case ...

Once you know what time the shutdown took place you can look in /var/adm/cron/log to see if any cron jobs ran immediately before.

MArk Syder (like the drink but spelt different)

Re: Shutdown LOG

Sampath_4 — Thu, 03 Nov 2005 02:44:07 GMT

the problem seemed to be some user shutting the machine remotely . Since he is clearing all his tracks i couldnt able to trace the user.I have moved the shutdown and reboot files , then he used the init 0 . He got the tip , then he stopped doing it .Now i have wrapped the shutdown and reboot in to a script which will log the user information in some file so that i can trace him once he tries to do it again. thanks for all your valuable information.