System auto-rebooted

[Thomas Greig]

our HP C3750, hp-ux 11i, rebooted during the night without a cause.

/var/adm/syslog/OLDsyslog.log shows the last line:
Oct 12 06:08:26 kristin diagmond[1636]: Exit due to user requested abort
Oct 12 06:08:27 kristin FontServer[1498]: terminating
Oct 12 06:08:32 kristin inetd[999]: Going down on signal 15
Oct 12 06:08:35 kristin rpcbind: terminate: rpcbind terminating on signal. Restart with "rpcbind -w"
Oct 12 06:08:35 kristin syslogd: going down on signal 15

the /var/tombstones/ts99 looks ok in my eyes. (check attatchment)

theres no files under /var/adm/crash

[Bharat Katkar]

Hi Thomas,
There is no attachment...
Also can you tell us what is there in /etc/shutdownlog?

Regards,

[Thomas Greig]

sorry. got a errormsg while posting the query. will try again.

the
/etc/shutdownlogs last entry is:
17:46 Tue Oct 5, 2004. Reboot: (by kristin!root)
06:08 Tue Oct 12, 2004. Halt:

[Sridhar Bhaskarla]

Hi,

Looks like system didn't crash on it's own. inetd and syslogd did go down normally. I would check the shell history. Or check if there is any cronjob that automatically performed any patch/software update.

Or if you installed any patches that required reboot and if you didn't close the swinstall window but later killed the swagentd process can result this too.

-Sri

[Bharat Katkar]

Hi,
As also sridhar has pointed out it looks like some of system process has issued halt to the system and system has rebooted. This happened in the early morning at 06:08 am.

I don't see any hardware failure or problem in this. Try to analyse your yesterdays activities on your system.

Hope that helps.
Regards,

[Thomas Greig]

I will try to backtrace what happened. I saw that one of the users logged in as su 5min. before the reboot. I would not be surprised if he says he "might have done something" but it was not on purpose.."

atleast no harm was done. they lost 10min processingtime but I'm sure they used that to get a cup of coffee instead.

thanx for your views/help.

Greigster

[Thomas Greig]

I'm not able to submit points. 'service unavailable'. will do this later.

[Trond Haugen]

If there is a history file for root you may want to have a look at it before the "last commands" are lost.

Regards,
Trond

[Thomas Greig]

no suspicious things in the .history of root.. :
.
.
cd /BACKUP/Files/multidata/
#+1097046132
ll
#+1097478985
rlogin mikkel
#+1097561711
#### This is when I've got the msg that it was booted
who -r
#+1097561747
cd /var/adm/syslog/
#+1097561748
ll
#+1097561756
vi OLDsyslog.log
.
.
.
.

[Muthukumar_5]

Your system was manually rebooted by root user from that machine kristin itself.

Check root users .history file informations for reboot / halt / shutdown informations there.

If you want to get to know who rebooted the system then analyse last output there. I hope it is not autorebooted there. Some one who knew root user account did that.

Get last login full informations there as,

last -R root

Related user login compared to shutdown time will be the one tried to shutdown. -R will give IP-Address / hostname there.

HTH.

HTH.