1833761 Members
2692 Online
110063 Solutions
New Discussion

Re: Phantom reboot?

 
Jason Moorhead_2
Frequent Advisor

Phantom reboot?

Hi all,

A very odd thing happened over the weekend... the syslog and sulog were reset and restarted, as if a reboot occured. An 'uptime' command on Sunday came back with an uptime of 1 day, also indicating a reboot. But the rbootd.log and STM show no reboot happened. Anyone ever seen this before, or know where else to look? Our application logs show nothing abnormal. Thanks!
9 REPLIES 9
Pete Randall
Outstanding Contributor

Re: Phantom reboot?

Jason,

Do a "ps -ef |grep init" and see what the timestamp is on the init process. That's a sure indication of a reboot.

Pete

Pete
Ken Hubnik_2
Honored Contributor

Re: Phantom reboot?

YEP, HP suspects a bug in the GSP firmware. They released version B.02.15 in December and was suppose to fix the problem but phamtom reboots were still occuring. They have sinced release B.02.17 on Jan 13th and they beleive it has resolved the problem.
Marco Santerre
Honored Contributor

Re: Phantom reboot?

You may want to check your GSP logs, they would indicate possible problems or shutdown.

Once on the GSP, do a SL, and check for errors. If the machine shut down on its own, chances are you will find an error log in here.
Cooperation is doing with a smile what you have to do anyhow.
harry d brown jr
Honored Contributor

Re: Phantom reboot?

What does "dmesg" report?

What messages are in the syslog "log" files?

live free or die
harry
Live Free or Die
Jeff Schussele
Honored Contributor

Re: Phantom reboot?

Hi Jason,

What does the /etc/shutdownlog show?

Did a tombstone get created?

Rgds,
Jeff
PERSEVERANCE -- Remember, whatever does not kill you only makes you stronger!
Stanimir
Trusted Contributor

Re: Phantom reboot?

Hi!
As far as I know rbootd is remote-boot-daemon,
but bootpd is BOOT-daemon, ruled by inetd.
So I suppose you had real reboot for
some reason.
Anyway you can use bootpquery for test-needs,
see man bootpquery.
And also it is not a bad idea to edit your shutdown.allow & shutdown.deny files.
Regards,Stan
Steven E. Protter
Exalted Contributor

Re: Phantom reboot?

This kind of activity can be the sign of several issues:

1) Power supply UPS issues. Check that these are working.
2) Possible security breach. I'd reset the root password, check the wtmp and btmp with the last and lastb commands and be very vigilant.

If physical and network security is good, its more likely to be in the realm of item 1. The prior posts should help you track it down.

P
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Jason Moorhead_2
Frequent Advisor

Re: Phantom reboot?

The shutdownlog shows no reboot for the time we suspect. Unfortunately, I actually did a reboot yesturday (Sunday), so getting the timestamp on the init process won't help.

I'm not very familiar with using the GSP. What exactly would I do with it to help troubleshoot this?

Thanks again!
Marco Santerre
Honored Contributor

Re: Phantom reboot?

Jason,

to access the GSP, you have to go on your console (LAN, serial, or web). You enter your Service processor login and password. Then you press the Ctrl-B and you are at the GSP prompt. Once there, you type SL to access your Chassis Logs. I would select Errors. On the GSP if you need help, you can always type HE. Once you are done, you type in CO to go back to console Mode.
Cooperation is doing with a smile what you have to do anyhow.