topic Re: System auto-rebooted in Operating System - HP-UX

System auto-rebooted

Thomas Greig — Tue, 12 Oct 2004 01:39:30 GMT

our HP C3750, hp-ux 11i, rebooted during the night without a cause.

/var/adm/syslog/OLDsyslog.log shows the last line:
Oct 12 06:08:26 kristin diagmond[1636]: Exit due to user requested abort
Oct 12 06:08:27 kristin FontServer[1498]: terminating
Oct 12 06:08:32 kristin inetd[999]: Going down on signal 15
Oct 12 06:08:35 kristin rpcbind: terminate: rpcbind terminating on signal. Restart with "rpcbind -w"
Oct 12 06:08:35 kristin syslogd: going down on signal 15

the /var/tombstones/ts99 looks ok in my eyes. (check attatchment)

theres no files under /var/adm/crash

Re: System auto-rebooted

Bharat Katkar — Tue, 12 Oct 2004 02:13:29 GMT

Hi Thomas,
There is no attachment...
Also can you tell us what is there in /etc/shutdownlog?

Regards,

Re: System auto-rebooted

Thomas Greig — Tue, 12 Oct 2004 02:17:19 GMT

sorry. got a errormsg while posting the query. will try again.

the
/etc/shutdownlogs last entry is:
17:46 Tue Oct 5, 2004. Reboot: (by kristin!root)
06:08 Tue Oct 12, 2004. Halt:

Re: System auto-rebooted

Sridhar Bhaskarla — Tue, 12 Oct 2004 02:24:09 GMT

Hi,

Looks like system didn't crash on it's own. inetd and syslogd did go down normally. I would check the shell history. Or check if there is any cronjob that automatically performed any patch/software update.

Or if you installed any patches that required reboot and if you didn't close the swinstall window but later killed the swagentd process can result this too.

-Sri

Re: System auto-rebooted

Bharat Katkar — Tue, 12 Oct 2004 02:37:58 GMT

Hi,
As also sridhar has pointed out it looks like some of system process has issued halt to the system and system has rebooted. This happened in the early morning at 06:08 am.

I don't see any hardware failure or problem in this. Try to analyse your yesterdays activities on your system.

Hope that helps.
Regards,

Re: System auto-rebooted

Thomas Greig — Tue, 12 Oct 2004 02:40:26 GMT

I will try to backtrace what happened. I saw that one of the users logged in as su 5min. before the reboot. I would not be surprised if he says he "might have done something" but it was not on purpose.."

atleast no harm was done. they lost 10min processingtime but I'm sure they used that to get a cup of coffee instead.

thanx for your views/help.

Greigster

Re: System auto-rebooted

Thomas Greig — Tue, 12 Oct 2004 02:41:25 GMT

I'm not able to submit points. 'service unavailable'. will do this later.

Re: System auto-rebooted

Trond Haugen — Tue, 12 Oct 2004 03:19:13 GMT

If there is a history file for root you may want to have a look at it before the "last commands" are lost.

Regards,
Trond

Re: System auto-rebooted

Thomas Greig — Tue, 12 Oct 2004 03:25:39 GMT

no suspicious things in the .history of root.. :
.
.
cd /BACKUP/Files/multidata/
#+1097046132
ll
#+1097478985
rlogin mikkel
#+1097561711
#### This is when I've got the msg that it was booted
who -r
#+1097561747
cd /var/adm/syslog/
#+1097561748
ll
#+1097561756
vi OLDsyslog.log
.
.
.
.

Re: System auto-rebooted

Muthukumar_5 — Tue, 12 Oct 2004 04:39:25 GMT

Your system was manually rebooted by root user from that machine kristin itself.

Check root users .history file informations for reboot / halt / shutdown informations there.

If you want to get to know who rebooted the system then analyse last output there. I hope it is not autorebooted there. Some one who knew root user account did that.

Get last login full informations there as,

last -R root

Related user login compared to shutdown time will be the one tried to shutdown. -R will give IP-Address / hostname there.

HTH.

HTH.

Re: System auto-rebooted

Bill Hassell — Tue, 12 Oct 2004 04:58:54 GMT

cat the /etc/shutdownlog file. That should tell what happened and when. Compare the timestamp with login information.